xmrig | 282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2025, 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
Size

1.1MB
MD5

591c1fef95285614991162d40a29f728
SHA1

43617de185f38186678adf29e696d30426f2edff
SHA256

282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c
SHA512

4d8f335c9cb1c76ef3b14bfa4cec8ec1cacdfdf14bbcf63c697002dd5b560cfe53d084a5b938d7cc85a4850e07a2f40eed509dd45213681aa2348675ac0d4dbf
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMrt0cEGk6:GezaTF8FcNkNdfE0pZ9ozttwIRQu7GL

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023b41-6.dat	xmrig
behavioral2/files/0x000c000000023b38-7.dat	xmrig
behavioral2/files/0x000a000000023b42-16.dat	xmrig
behavioral2/files/0x000a000000023b44-24.dat	xmrig
behavioral2/files/0x000a000000023b4a-57.dat	xmrig
behavioral2/files/0x000a000000023b4e-77.dat	xmrig
behavioral2/files/0x000a000000023b55-120.dat	xmrig
behavioral2/files/0x0009000000023b76-160.dat	xmrig
behavioral2/files/0x0009000000023b78-162.dat	xmrig
behavioral2/files/0x0009000000023b77-157.dat	xmrig
behavioral2/files/0x0008000000023b71-155.dat	xmrig
behavioral2/files/0x000e000000023b68-150.dat	xmrig
behavioral2/files/0x000a000000023b61-145.dat	xmrig
behavioral2/files/0x000b000000023b59-140.dat	xmrig
behavioral2/files/0x000b000000023b58-135.dat	xmrig
behavioral2/files/0x000b000000023b57-130.dat	xmrig
behavioral2/files/0x000a000000023b56-125.dat	xmrig
behavioral2/files/0x000a000000023b54-115.dat	xmrig
behavioral2/files/0x000a000000023b53-110.dat	xmrig
behavioral2/files/0x000a000000023b52-105.dat	xmrig
behavioral2/files/0x000a000000023b51-100.dat	xmrig
behavioral2/files/0x000a000000023b50-95.dat	xmrig
behavioral2/files/0x000a000000023b4f-90.dat	xmrig
behavioral2/files/0x000a000000023b4d-80.dat	xmrig
behavioral2/files/0x000a000000023b4c-75.dat	xmrig
behavioral2/files/0x000a000000023b4b-70.dat	xmrig
behavioral2/files/0x000a000000023b49-60.dat	xmrig
behavioral2/files/0x000a000000023b48-55.dat	xmrig
behavioral2/files/0x000a000000023b47-50.dat	xmrig
behavioral2/files/0x000a000000023b46-45.dat	xmrig
behavioral2/files/0x000a000000023b45-40.dat	xmrig
behavioral2/files/0x000a000000023b43-25.dat	xmrig
behavioral2/files/0x000c000000023aed-10.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4728	LiUaFjK.exe
428	OusiOso.exe
812	mdFRjiM.exe
3420	lETjWLR.exe
4216	tASPoqu.exe
3588	kkqtHyw.exe
4264	WFaVVlE.exe
4084	klbAwPe.exe
3560	gpAbZuR.exe
2972	OYKPfcb.exe
3480	tzvukaq.exe
3260	cruZFBn.exe
1928	eTuoIWv.exe
3600	vrCyxol.exe
3780	mgDWiAB.exe
4224	GUMYjWE.exe
4992	GIsJLfi.exe
3980	SFJqNTX.exe
5072	bPjxBeC.exe
4588	GFvjvHZ.exe
3268	sSCJHwe.exe
4252	TavFbjx.exe
2352	FyiAxUG.exe
2508	NklZljZ.exe
3316	nopUgBb.exe
1604	kKwPujq.exe
1380	uzEoVwv.exe
1320	XSlzqvZ.exe
4336	RmJJWjY.exe
1144	QpUYbFR.exe
3252	fSkkvcV.exe
4016	LgaIcYg.exe
2192	qBZGMwH.exe
3504	PxeJgAo.exe
1984	kIbVpYz.exe
3256	PRUyrEu.exe
4700	KQBVezF.exe
5064	SArHmTp.exe
756	fquKfVQ.exe
540	oqQATBw.exe
468	kiKtVMM.exe
1576	oDqAchR.exe
4360	zgjYOVH.exe
2288	ICPrGDM.exe
3384	OFluNwc.exe
2432	ILWQhSk.exe
3604	NmKCUOl.exe
1744	Xmxoxam.exe
3416	dsvpGLM.exe
4108	MGgDgeX.exe
4032	rPaKghR.exe
4444	rdJhJdJ.exe
4620	iXkWYBy.exe
4704	ElIHiCD.exe
208	qQMbhUD.exe
4328	LbLudDz.exe
4784	ZDLOHZR.exe
2740	VUcScIi.exe
3028	nffMcnG.exe
3276	JbuqFNl.exe
2400	SipApPR.exe
2032	JWvYrEB.exe
5044	iytBypB.exe
1072	UikvYLU.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zwVJTkR.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\JXiIZHH.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\jqXXYHP.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\TSdygQT.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\Crritgf.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\LkwyzrH.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\oDqAchR.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\hSOTFHY.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\jVLqaHt.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\aAeDPlx.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\OjanmHP.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\MmflMpQ.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\ookeNRt.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\dRGDpPu.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\toSxzzu.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\rpvxOrs.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\kySMywA.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\yyNXdGJ.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\tzvukaq.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\NBthJEx.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\DgWBteS.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\eHUIHBF.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\qAoxsDM.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\uuThBNC.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\mpqLAqj.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\PgigqPv.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\FExfHtp.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\AiZIGpI.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\oNSoXiM.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\HMKsTGI.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\VkEHiRx.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\HRkpMrw.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\xNAOasa.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\pXMCURu.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\qwkRNVk.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\IDDVGVW.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\vrCyxol.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\PRUyrEu.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\rPaKghR.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\ZqRhhRe.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\Pjiascf.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\DhUhViG.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\DqzlAPy.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\UdWrWgR.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\PFquqgi.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\XwEVDAH.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\cxOypJx.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\rUGgyIw.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\dQduSUN.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\wvplKmg.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\vrvSXvI.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\LpnsCyl.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\WYTcWET.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\jKtgclO.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\LJZNKdr.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\yocZbMG.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\pIEYcuJ.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\ryiVerb.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\zNcZNfq.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\klbAwPe.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\abFKvqk.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\zCFjGxl.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\DMLZmgt.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
File created	C:\Windows\System\LiUaFjK.exe	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16712	dwm.exe
Token: SeChangeNotifyPrivilege	16712	dwm.exe
Token: 33	16712	dwm.exe
Token: SeIncBasePriorityPrivilege	16712	dwm.exe
Token: SeShutdownPrivilege	16712	dwm.exe
Token: SeCreatePagefilePrivilege	16712	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 4728	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	84
PID 1208 wrote to memory of 4728	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	84
PID 1208 wrote to memory of 428	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	85
PID 1208 wrote to memory of 428	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	85
PID 1208 wrote to memory of 4216	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	87
PID 1208 wrote to memory of 4216	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	87
PID 1208 wrote to memory of 812	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	88
PID 1208 wrote to memory of 812	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	88
PID 1208 wrote to memory of 3420	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	89
PID 1208 wrote to memory of 3420	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	89
PID 1208 wrote to memory of 3588	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	90
PID 1208 wrote to memory of 3588	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	90
PID 1208 wrote to memory of 4264	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	91
PID 1208 wrote to memory of 4264	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	91
PID 1208 wrote to memory of 4084	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	92
PID 1208 wrote to memory of 4084	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	92
PID 1208 wrote to memory of 3560	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	93
PID 1208 wrote to memory of 3560	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	93
PID 1208 wrote to memory of 2972	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	94
PID 1208 wrote to memory of 2972	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	94
PID 1208 wrote to memory of 3480	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	95
PID 1208 wrote to memory of 3480	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	95
PID 1208 wrote to memory of 3260	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	96
PID 1208 wrote to memory of 3260	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	96
PID 1208 wrote to memory of 1928	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	97
PID 1208 wrote to memory of 1928	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	97
PID 1208 wrote to memory of 3600	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	98
PID 1208 wrote to memory of 3600	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	98
PID 1208 wrote to memory of 3780	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	99
PID 1208 wrote to memory of 3780	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	99
PID 1208 wrote to memory of 4224	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	100
PID 1208 wrote to memory of 4224	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	100
PID 1208 wrote to memory of 4992	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	101
PID 1208 wrote to memory of 4992	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	101
PID 1208 wrote to memory of 3980	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	102
PID 1208 wrote to memory of 3980	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	102
PID 1208 wrote to memory of 5072	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	103
PID 1208 wrote to memory of 5072	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	103
PID 1208 wrote to memory of 4588	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	104
PID 1208 wrote to memory of 4588	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	104
PID 1208 wrote to memory of 3268	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	105
PID 1208 wrote to memory of 3268	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	105
PID 1208 wrote to memory of 4252	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	106
PID 1208 wrote to memory of 4252	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	106
PID 1208 wrote to memory of 2352	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	107
PID 1208 wrote to memory of 2352	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	107
PID 1208 wrote to memory of 2508	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	108
PID 1208 wrote to memory of 2508	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	108
PID 1208 wrote to memory of 3316	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	109
PID 1208 wrote to memory of 3316	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	109
PID 1208 wrote to memory of 1604	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	110
PID 1208 wrote to memory of 1604	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	110
PID 1208 wrote to memory of 1380	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	111
PID 1208 wrote to memory of 1380	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	111
PID 1208 wrote to memory of 1320	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	112
PID 1208 wrote to memory of 1320	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	112
PID 1208 wrote to memory of 4336	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	113
PID 1208 wrote to memory of 4336	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	113
PID 1208 wrote to memory of 1144	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	114
PID 1208 wrote to memory of 1144	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	114
PID 1208 wrote to memory of 3252	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	115
PID 1208 wrote to memory of 3252	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	115
PID 1208 wrote to memory of 4016	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	116
PID 1208 wrote to memory of 4016	1208	282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe	116

C:\Users\Admin\AppData\Local\Temp\282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe
"C:\Users\Admin\AppData\Local\Temp\282eee02d44cc7a2ca76c0494cea098ad8f0b25a14ea886bd15dac51c537416c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\System\LiUaFjK.exe
  C:\Windows\System\LiUaFjK.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\OusiOso.exe
  C:\Windows\System\OusiOso.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\tASPoqu.exe
  C:\Windows\System\tASPoqu.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\mdFRjiM.exe
  C:\Windows\System\mdFRjiM.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\lETjWLR.exe
  C:\Windows\System\lETjWLR.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\kkqtHyw.exe
  C:\Windows\System\kkqtHyw.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\WFaVVlE.exe
  C:\Windows\System\WFaVVlE.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\klbAwPe.exe
  C:\Windows\System\klbAwPe.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\gpAbZuR.exe
  C:\Windows\System\gpAbZuR.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\OYKPfcb.exe
  C:\Windows\System\OYKPfcb.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\tzvukaq.exe
  C:\Windows\System\tzvukaq.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\cruZFBn.exe
  C:\Windows\System\cruZFBn.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\eTuoIWv.exe
  C:\Windows\System\eTuoIWv.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\vrCyxol.exe
  C:\Windows\System\vrCyxol.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\mgDWiAB.exe
  C:\Windows\System\mgDWiAB.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\GUMYjWE.exe
  C:\Windows\System\GUMYjWE.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\GIsJLfi.exe
  C:\Windows\System\GIsJLfi.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\SFJqNTX.exe
  C:\Windows\System\SFJqNTX.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\bPjxBeC.exe
  C:\Windows\System\bPjxBeC.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\GFvjvHZ.exe
  C:\Windows\System\GFvjvHZ.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\sSCJHwe.exe
  C:\Windows\System\sSCJHwe.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\TavFbjx.exe
  C:\Windows\System\TavFbjx.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\FyiAxUG.exe
  C:\Windows\System\FyiAxUG.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\NklZljZ.exe
  C:\Windows\System\NklZljZ.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\nopUgBb.exe
  C:\Windows\System\nopUgBb.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\kKwPujq.exe
  C:\Windows\System\kKwPujq.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\uzEoVwv.exe
  C:\Windows\System\uzEoVwv.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\XSlzqvZ.exe
  C:\Windows\System\XSlzqvZ.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\RmJJWjY.exe
  C:\Windows\System\RmJJWjY.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\QpUYbFR.exe
  C:\Windows\System\QpUYbFR.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\fSkkvcV.exe
  C:\Windows\System\fSkkvcV.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\LgaIcYg.exe
  C:\Windows\System\LgaIcYg.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\qBZGMwH.exe
  C:\Windows\System\qBZGMwH.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\PxeJgAo.exe
  C:\Windows\System\PxeJgAo.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\kIbVpYz.exe
  C:\Windows\System\kIbVpYz.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\PRUyrEu.exe
  C:\Windows\System\PRUyrEu.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\KQBVezF.exe
  C:\Windows\System\KQBVezF.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\SArHmTp.exe
  C:\Windows\System\SArHmTp.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\fquKfVQ.exe
  C:\Windows\System\fquKfVQ.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\oqQATBw.exe
  C:\Windows\System\oqQATBw.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\kiKtVMM.exe
  C:\Windows\System\kiKtVMM.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\oDqAchR.exe
  C:\Windows\System\oDqAchR.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\zgjYOVH.exe
  C:\Windows\System\zgjYOVH.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\ICPrGDM.exe
  C:\Windows\System\ICPrGDM.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\OFluNwc.exe
  C:\Windows\System\OFluNwc.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\ILWQhSk.exe
  C:\Windows\System\ILWQhSk.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\NmKCUOl.exe
  C:\Windows\System\NmKCUOl.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\Xmxoxam.exe
  C:\Windows\System\Xmxoxam.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\dsvpGLM.exe
  C:\Windows\System\dsvpGLM.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\MGgDgeX.exe
  C:\Windows\System\MGgDgeX.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\rPaKghR.exe
  C:\Windows\System\rPaKghR.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\rdJhJdJ.exe
  C:\Windows\System\rdJhJdJ.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\iXkWYBy.exe
  C:\Windows\System\iXkWYBy.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\ElIHiCD.exe
  C:\Windows\System\ElIHiCD.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\qQMbhUD.exe
  C:\Windows\System\qQMbhUD.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\LbLudDz.exe
  C:\Windows\System\LbLudDz.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\ZDLOHZR.exe
  C:\Windows\System\ZDLOHZR.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\VUcScIi.exe
  C:\Windows\System\VUcScIi.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\nffMcnG.exe
  C:\Windows\System\nffMcnG.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\JbuqFNl.exe
  C:\Windows\System\JbuqFNl.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\SipApPR.exe
  C:\Windows\System\SipApPR.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\JWvYrEB.exe
  C:\Windows\System\JWvYrEB.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\iytBypB.exe
  C:\Windows\System\iytBypB.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\UikvYLU.exe
  C:\Windows\System\UikvYLU.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\mgCDZve.exe
  C:\Windows\System\mgCDZve.exe
  2⤵
  PID:4832
- C:\Windows\System\aJTOang.exe
  C:\Windows\System\aJTOang.exe
  2⤵
  PID:5108
- C:\Windows\System\cfyZpiK.exe
  C:\Windows\System\cfyZpiK.exe
  2⤵
  PID:4348
- C:\Windows\System\bGghFTm.exe
  C:\Windows\System\bGghFTm.exe
  2⤵
  PID:3032
- C:\Windows\System\dKAjiFt.exe
  C:\Windows\System\dKAjiFt.exe
  2⤵
  PID:2724
- C:\Windows\System\DCvNrFJ.exe
  C:\Windows\System\DCvNrFJ.exe
  2⤵
  PID:396
- C:\Windows\System\jHFubJB.exe
  C:\Windows\System\jHFubJB.exe
  2⤵
  PID:404
- C:\Windows\System\hSOTFHY.exe
  C:\Windows\System\hSOTFHY.exe
  2⤵
  PID:3356
- C:\Windows\System\hdUtQwO.exe
  C:\Windows\System\hdUtQwO.exe
  2⤵
  PID:1180
- C:\Windows\System\BtejySZ.exe
  C:\Windows\System\BtejySZ.exe
  2⤵
  PID:2068
- C:\Windows\System\mZouAub.exe
  C:\Windows\System\mZouAub.exe
  2⤵
  PID:4044
- C:\Windows\System\PMXNzaL.exe
  C:\Windows\System\PMXNzaL.exe
  2⤵
  PID:5024
- C:\Windows\System\IRDhHLd.exe
  C:\Windows\System\IRDhHLd.exe
  2⤵
  PID:3692
- C:\Windows\System\qSMnsXq.exe
  C:\Windows\System\qSMnsXq.exe
  2⤵
  PID:3896
- C:\Windows\System\iCKSuAV.exe
  C:\Windows\System\iCKSuAV.exe
  2⤵
  PID:1756
- C:\Windows\System\ELymFZp.exe
  C:\Windows\System\ELymFZp.exe
  2⤵
  PID:4452
- C:\Windows\System\doXXNOe.exe
  C:\Windows\System\doXXNOe.exe
  2⤵
  PID:4792
- C:\Windows\System\RLTcuyZ.exe
  C:\Windows\System\RLTcuyZ.exe
  2⤵
  PID:3196
- C:\Windows\System\vecHpQu.exe
  C:\Windows\System\vecHpQu.exe
  2⤵
  PID:5128
- C:\Windows\System\GHNvPOR.exe
  C:\Windows\System\GHNvPOR.exe
  2⤵
  PID:5148
- C:\Windows\System\iXZWDAb.exe
  C:\Windows\System\iXZWDAb.exe
  2⤵
  PID:5176
- C:\Windows\System\GTQfmEF.exe
  C:\Windows\System\GTQfmEF.exe
  2⤵
  PID:5204
- C:\Windows\System\DjjjjEH.exe
  C:\Windows\System\DjjjjEH.exe
  2⤵
  PID:5232
- C:\Windows\System\iMgdyHt.exe
  C:\Windows\System\iMgdyHt.exe
  2⤵
  PID:5260
- C:\Windows\System\JXvQLrp.exe
  C:\Windows\System\JXvQLrp.exe
  2⤵
  PID:5292
- C:\Windows\System\XTZuNFK.exe
  C:\Windows\System\XTZuNFK.exe
  2⤵
  PID:5320
- C:\Windows\System\zlWLoNC.exe
  C:\Windows\System\zlWLoNC.exe
  2⤵
  PID:5344
- C:\Windows\System\kioJXJB.exe
  C:\Windows\System\kioJXJB.exe
  2⤵
  PID:5376
- C:\Windows\System\iSRnjro.exe
  C:\Windows\System\iSRnjro.exe
  2⤵
  PID:5404
- C:\Windows\System\Jkcrxgq.exe
  C:\Windows\System\Jkcrxgq.exe
  2⤵
  PID:5428
- C:\Windows\System\wmlGmvw.exe
  C:\Windows\System\wmlGmvw.exe
  2⤵
  PID:5456
- C:\Windows\System\rdLPHUp.exe
  C:\Windows\System\rdLPHUp.exe
  2⤵
  PID:5480
- C:\Windows\System\QWfcXfT.exe
  C:\Windows\System\QWfcXfT.exe
  2⤵
  PID:5516
- C:\Windows\System\mbGMIJa.exe
  C:\Windows\System\mbGMIJa.exe
  2⤵
  PID:5544
- C:\Windows\System\eHoamNh.exe
  C:\Windows\System\eHoamNh.exe
  2⤵
  PID:5568
- C:\Windows\System\bZXYKht.exe
  C:\Windows\System\bZXYKht.exe
  2⤵
  PID:5600
- C:\Windows\System\gBQhegF.exe
  C:\Windows\System\gBQhegF.exe
  2⤵
  PID:5624
- C:\Windows\System\fRLQNxe.exe
  C:\Windows\System\fRLQNxe.exe
  2⤵
  PID:5656
- C:\Windows\System\pBnqgjv.exe
  C:\Windows\System\pBnqgjv.exe
  2⤵
  PID:5684
- C:\Windows\System\ejpdJOc.exe
  C:\Windows\System\ejpdJOc.exe
  2⤵
  PID:5708
- C:\Windows\System\ezQiqsY.exe
  C:\Windows\System\ezQiqsY.exe
  2⤵
  PID:5736
- C:\Windows\System\VytAXCK.exe
  C:\Windows\System\VytAXCK.exe
  2⤵
  PID:5764
- C:\Windows\System\WYTcWET.exe
  C:\Windows\System\WYTcWET.exe
  2⤵
  PID:5788
- C:\Windows\System\YDJeNGi.exe
  C:\Windows\System\YDJeNGi.exe
  2⤵
  PID:5820
- C:\Windows\System\IaOJmts.exe
  C:\Windows\System\IaOJmts.exe
  2⤵
  PID:5852
- C:\Windows\System\pvOLpzL.exe
  C:\Windows\System\pvOLpzL.exe
  2⤵
  PID:5876
- C:\Windows\System\FOJUTiN.exe
  C:\Windows\System\FOJUTiN.exe
  2⤵
  PID:5908
- C:\Windows\System\LvGyznp.exe
  C:\Windows\System\LvGyznp.exe
  2⤵
  PID:5932
- C:\Windows\System\zUhYcJs.exe
  C:\Windows\System\zUhYcJs.exe
  2⤵
  PID:5960
- C:\Windows\System\qIHsKSf.exe
  C:\Windows\System\qIHsKSf.exe
  2⤵
  PID:5988
- C:\Windows\System\HerjBHO.exe
  C:\Windows\System\HerjBHO.exe
  2⤵
  PID:6024
- C:\Windows\System\mtqrtTK.exe
  C:\Windows\System\mtqrtTK.exe
  2⤵
  PID:6048
- C:\Windows\System\CdposTS.exe
  C:\Windows\System\CdposTS.exe
  2⤵
  PID:6072
- C:\Windows\System\OZNqRDj.exe
  C:\Windows\System\OZNqRDj.exe
  2⤵
  PID:6100
- C:\Windows\System\VOTVVmC.exe
  C:\Windows\System\VOTVVmC.exe
  2⤵
  PID:6128
- C:\Windows\System\LHTlgow.exe
  C:\Windows\System\LHTlgow.exe
  2⤵
  PID:4616
- C:\Windows\System\QQuuQpW.exe
  C:\Windows\System\QQuuQpW.exe
  2⤵
  PID:3900
- C:\Windows\System\uuThBNC.exe
  C:\Windows\System\uuThBNC.exe
  2⤵
  PID:1920
- C:\Windows\System\HrHUuGM.exe
  C:\Windows\System\HrHUuGM.exe
  2⤵
  PID:4948
- C:\Windows\System\DEezsgb.exe
  C:\Windows\System\DEezsgb.exe
  2⤵
  PID:4768
- C:\Windows\System\OClNzgD.exe
  C:\Windows\System\OClNzgD.exe
  2⤵
  PID:2244
- C:\Windows\System\jWMnbdl.exe
  C:\Windows\System\jWMnbdl.exe
  2⤵
  PID:2028
- C:\Windows\System\SVUsooF.exe
  C:\Windows\System\SVUsooF.exe
  2⤵
  PID:3792
- C:\Windows\System\jVLqaHt.exe
  C:\Windows\System\jVLqaHt.exe
  2⤵
  PID:4932
- C:\Windows\System\mULuUCD.exe
  C:\Windows\System\mULuUCD.exe
  2⤵
  PID:5168
- C:\Windows\System\tLzHbEA.exe
  C:\Windows\System\tLzHbEA.exe
  2⤵
  PID:5224
- C:\Windows\System\fhLoETp.exe
  C:\Windows\System\fhLoETp.exe
  2⤵
  PID:5300
- C:\Windows\System\fBucsNC.exe
  C:\Windows\System\fBucsNC.exe
  2⤵
  PID:5364
- C:\Windows\System\dwezFUY.exe
  C:\Windows\System\dwezFUY.exe
  2⤵
  PID:5440
- C:\Windows\System\zeyoeGi.exe
  C:\Windows\System\zeyoeGi.exe
  2⤵
  PID:5496
- C:\Windows\System\BOnBpFi.exe
  C:\Windows\System\BOnBpFi.exe
  2⤵
  PID:5560
- C:\Windows\System\HLfSrJy.exe
  C:\Windows\System\HLfSrJy.exe
  2⤵
  PID:5620
- C:\Windows\System\sDUhjql.exe
  C:\Windows\System\sDUhjql.exe
  2⤵
  PID:5692
- C:\Windows\System\saYAIFp.exe
  C:\Windows\System\saYAIFp.exe
  2⤵
  PID:5752
- C:\Windows\System\QzenTIm.exe
  C:\Windows\System\QzenTIm.exe
  2⤵
  PID:5812
- C:\Windows\System\wrbLIHr.exe
  C:\Windows\System\wrbLIHr.exe
  2⤵
  PID:5888
- C:\Windows\System\tiliZxv.exe
  C:\Windows\System\tiliZxv.exe
  2⤵
  PID:5948
- C:\Windows\System\YzoOyio.exe
  C:\Windows\System\YzoOyio.exe
  2⤵
  PID:6012
- C:\Windows\System\NBthJEx.exe
  C:\Windows\System\NBthJEx.exe
  2⤵
  PID:6068
- C:\Windows\System\CueAuVg.exe
  C:\Windows\System\CueAuVg.exe
  2⤵
  PID:6140
- C:\Windows\System\jKtgclO.exe
  C:\Windows\System\jKtgclO.exe
  2⤵
  PID:2948
- C:\Windows\System\osbTxaH.exe
  C:\Windows\System\osbTxaH.exe
  2⤵
  PID:3708
- C:\Windows\System\KyLrczp.exe
  C:\Windows\System\KyLrczp.exe
  2⤵
  PID:6164
- C:\Windows\System\APmlPEe.exe
  C:\Windows\System\APmlPEe.exe
  2⤵
  PID:6192
- C:\Windows\System\kXNkCGS.exe
  C:\Windows\System\kXNkCGS.exe
  2⤵
  PID:6220
- C:\Windows\System\PxILoRm.exe
  C:\Windows\System\PxILoRm.exe
  2⤵
  PID:6248
- C:\Windows\System\byzNqzk.exe
  C:\Windows\System\byzNqzk.exe
  2⤵
  PID:6344
- C:\Windows\System\acouuQI.exe
  C:\Windows\System\acouuQI.exe
  2⤵
  PID:6360
- C:\Windows\System\VoUvatE.exe
  C:\Windows\System\VoUvatE.exe
  2⤵
  PID:6376
- C:\Windows\System\unvRtOh.exe
  C:\Windows\System\unvRtOh.exe
  2⤵
  PID:6392
- C:\Windows\System\pnYTOHM.exe
  C:\Windows\System\pnYTOHM.exe
  2⤵
  PID:6420
- C:\Windows\System\qwailhO.exe
  C:\Windows\System\qwailhO.exe
  2⤵
  PID:6448
- C:\Windows\System\rimCpZI.exe
  C:\Windows\System\rimCpZI.exe
  2⤵
  PID:6476
- C:\Windows\System\wIOJbjl.exe
  C:\Windows\System\wIOJbjl.exe
  2⤵
  PID:6500
- C:\Windows\System\PIMHAGI.exe
  C:\Windows\System\PIMHAGI.exe
  2⤵
  PID:6528
- C:\Windows\System\HddOIXV.exe
  C:\Windows\System\HddOIXV.exe
  2⤵
  PID:6556
- C:\Windows\System\oInEnvl.exe
  C:\Windows\System\oInEnvl.exe
  2⤵
  PID:6588
- C:\Windows\System\CVLzrff.exe
  C:\Windows\System\CVLzrff.exe
  2⤵
  PID:6616
- C:\Windows\System\NxFMycK.exe
  C:\Windows\System\NxFMycK.exe
  2⤵
  PID:6632
- C:\Windows\System\OLlgNei.exe
  C:\Windows\System\OLlgNei.exe
  2⤵
  PID:6660
- C:\Windows\System\etBWXGL.exe
  C:\Windows\System\etBWXGL.exe
  2⤵
  PID:6696
- C:\Windows\System\vcagxOx.exe
  C:\Windows\System\vcagxOx.exe
  2⤵
  PID:6724
- C:\Windows\System\AJvAQcq.exe
  C:\Windows\System\AJvAQcq.exe
  2⤵
  PID:6752
- C:\Windows\System\vIeywZi.exe
  C:\Windows\System\vIeywZi.exe
  2⤵
  PID:6780
- C:\Windows\System\WqMmPwC.exe
  C:\Windows\System\WqMmPwC.exe
  2⤵
  PID:6812
- C:\Windows\System\GpVJMwa.exe
  C:\Windows\System\GpVJMwa.exe
  2⤵
  PID:6840
- C:\Windows\System\iYvhMdK.exe
  C:\Windows\System\iYvhMdK.exe
  2⤵
  PID:6864
- C:\Windows\System\ebXPlFq.exe
  C:\Windows\System\ebXPlFq.exe
  2⤵
  PID:6896
- C:\Windows\System\tztoAgU.exe
  C:\Windows\System\tztoAgU.exe
  2⤵
  PID:6924
- C:\Windows\System\fhAKNMI.exe
  C:\Windows\System\fhAKNMI.exe
  2⤵
  PID:6948
- C:\Windows\System\ysrIfKy.exe
  C:\Windows\System\ysrIfKy.exe
  2⤵
  PID:6980
- C:\Windows\System\AbVESio.exe
  C:\Windows\System\AbVESio.exe
  2⤵
  PID:7008
- C:\Windows\System\kNrqrAF.exe
  C:\Windows\System\kNrqrAF.exe
  2⤵
  PID:7032
- C:\Windows\System\FZntunC.exe
  C:\Windows\System\FZntunC.exe
  2⤵
  PID:7060
- C:\Windows\System\OZuNVzD.exe
  C:\Windows\System\OZuNVzD.exe
  2⤵
  PID:7088
- C:\Windows\System\Pwrellb.exe
  C:\Windows\System\Pwrellb.exe
  2⤵
  PID:7116
- C:\Windows\System\SXAGekZ.exe
  C:\Windows\System\SXAGekZ.exe
  2⤵
  PID:7144
- C:\Windows\System\aaNHonR.exe
  C:\Windows\System\aaNHonR.exe
  2⤵
  PID:948
- C:\Windows\System\qRgrRoa.exe
  C:\Windows\System\qRgrRoa.exe
  2⤵
  PID:4316
- C:\Windows\System\wSXplyd.exe
  C:\Windows\System\wSXplyd.exe
  2⤵
  PID:5220
- C:\Windows\System\hKtwNtj.exe
  C:\Windows\System\hKtwNtj.exe
  2⤵
  PID:5328
- C:\Windows\System\bBQZZgp.exe
  C:\Windows\System\bBQZZgp.exe
  2⤵
  PID:5420
- C:\Windows\System\CLksnHG.exe
  C:\Windows\System\CLksnHG.exe
  2⤵
  PID:5584
- C:\Windows\System\SLiHEmD.exe
  C:\Windows\System\SLiHEmD.exe
  2⤵
  PID:5728
- C:\Windows\System\HOjHjOM.exe
  C:\Windows\System\HOjHjOM.exe
  2⤵
  PID:5868
- C:\Windows\System\DvgQjOi.exe
  C:\Windows\System\DvgQjOi.exe
  2⤵
  PID:6040
- C:\Windows\System\oVjmnqV.exe
  C:\Windows\System\oVjmnqV.exe
  2⤵
  PID:1184
- C:\Windows\System\NXEOKMw.exe
  C:\Windows\System\NXEOKMw.exe
  2⤵
  PID:6148
- C:\Windows\System\uqrvQim.exe
  C:\Windows\System\uqrvQim.exe
  2⤵
  PID:6204
- C:\Windows\System\ZZZgLHH.exe
  C:\Windows\System\ZZZgLHH.exe
  2⤵
  PID:6264
- C:\Windows\System\KHJQtHg.exe
  C:\Windows\System\KHJQtHg.exe
  2⤵
  PID:6356
- C:\Windows\System\wqTBXlD.exe
  C:\Windows\System\wqTBXlD.exe
  2⤵
  PID:6432
- C:\Windows\System\ZqRhhRe.exe
  C:\Windows\System\ZqRhhRe.exe
  2⤵
  PID:6492
- C:\Windows\System\KbVZmUG.exe
  C:\Windows\System\KbVZmUG.exe
  2⤵
  PID:6548
- C:\Windows\System\qXJvYFk.exe
  C:\Windows\System\qXJvYFk.exe
  2⤵
  PID:1972
- C:\Windows\System\EIpVcdC.exe
  C:\Windows\System\EIpVcdC.exe
  2⤵
  PID:6680
- C:\Windows\System\lrChWYp.exe
  C:\Windows\System\lrChWYp.exe
  2⤵
  PID:6768
- C:\Windows\System\XWXxQqV.exe
  C:\Windows\System\XWXxQqV.exe
  2⤵
  PID:6828
- C:\Windows\System\hNJEorl.exe
  C:\Windows\System\hNJEorl.exe
  2⤵
  PID:2284
- C:\Windows\System\HPiDinN.exe
  C:\Windows\System\HPiDinN.exe
  2⤵
  PID:6916
- C:\Windows\System\PCfToJE.exe
  C:\Windows\System\PCfToJE.exe
  2⤵
  PID:6972
- C:\Windows\System\HegPUxM.exe
  C:\Windows\System\HegPUxM.exe
  2⤵
  PID:7084
- C:\Windows\System\VyjnxDr.exe
  C:\Windows\System\VyjnxDr.exe
  2⤵
  PID:7140
- C:\Windows\System\lInfwiL.exe
  C:\Windows\System\lInfwiL.exe
  2⤵
  PID:3168
- C:\Windows\System\eSqjePY.exe
  C:\Windows\System\eSqjePY.exe
  2⤵
  PID:668
- C:\Windows\System\nlgeyVM.exe
  C:\Windows\System\nlgeyVM.exe
  2⤵
  PID:5412
- C:\Windows\System\KRmDMUM.exe
  C:\Windows\System\KRmDMUM.exe
  2⤵
  PID:2820
- C:\Windows\System\woGWPqV.exe
  C:\Windows\System\woGWPqV.exe
  2⤵
  PID:5672
- C:\Windows\System\ueGGDBB.exe
  C:\Windows\System\ueGGDBB.exe
  2⤵
  PID:3608
- C:\Windows\System\ypsCvFo.exe
  C:\Windows\System\ypsCvFo.exe
  2⤵
  PID:6000
- C:\Windows\System\ZDmyoDb.exe
  C:\Windows\System\ZDmyoDb.exe
  2⤵
  PID:4124
- C:\Windows\System\XPFwpPy.exe
  C:\Windows\System\XPFwpPy.exe
  2⤵
  PID:6176
- C:\Windows\System\IHwNROM.exe
  C:\Windows\System\IHwNROM.exe
  2⤵
  PID:2860
- C:\Windows\System\BvaiojA.exe
  C:\Windows\System\BvaiojA.exe
  2⤵
  PID:3380
- C:\Windows\System\yJXrtzK.exe
  C:\Windows\System\yJXrtzK.exe
  2⤵
  PID:6524
- C:\Windows\System\HUSBKWA.exe
  C:\Windows\System\HUSBKWA.exe
  2⤵
  PID:3236
- C:\Windows\System\otMWDgr.exe
  C:\Windows\System\otMWDgr.exe
  2⤵
  PID:6716
- C:\Windows\System\ByImJxg.exe
  C:\Windows\System\ByImJxg.exe
  2⤵
  PID:1048
- C:\Windows\System\AjmenlV.exe
  C:\Windows\System\AjmenlV.exe
  2⤵
  PID:4748
- C:\Windows\System\sOECDvg.exe
  C:\Windows\System\sOECDvg.exe
  2⤵
  PID:2264
- C:\Windows\System\CEHvbqF.exe
  C:\Windows\System\CEHvbqF.exe
  2⤵
  PID:5276
- C:\Windows\System\abFKvqk.exe
  C:\Windows\System\abFKvqk.exe
  2⤵
  PID:5532
- C:\Windows\System\gLEuBYG.exe
  C:\Windows\System\gLEuBYG.exe
  2⤵
  PID:5192
- C:\Windows\System\uDurIrr.exe
  C:\Windows\System\uDurIrr.exe
  2⤵
  PID:5840
- C:\Windows\System\ZYHUjBh.exe
  C:\Windows\System\ZYHUjBh.exe
  2⤵
  PID:6352
- C:\Windows\System\RMYXuUd.exe
  C:\Windows\System\RMYXuUd.exe
  2⤵
  PID:2900
- C:\Windows\System\avSeoej.exe
  C:\Windows\System\avSeoej.exe
  2⤵
  PID:6912
- C:\Windows\System\VUFUGtg.exe
  C:\Windows\System\VUFUGtg.exe
  2⤵
  PID:5092
- C:\Windows\System\IOoBEnk.exe
  C:\Windows\System\IOoBEnk.exe
  2⤵
  PID:7164
- C:\Windows\System\PHnHXQN.exe
  C:\Windows\System\PHnHXQN.exe
  2⤵
  PID:6580
- C:\Windows\System\tYBPMbA.exe
  C:\Windows\System\tYBPMbA.exe
  2⤵
  PID:2304
- C:\Windows\System\KMvHQva.exe
  C:\Windows\System\KMvHQva.exe
  2⤵
  PID:4780
- C:\Windows\System\zbooZoC.exe
  C:\Windows\System\zbooZoC.exe
  2⤵
  PID:6944
- C:\Windows\System\AkdjGAK.exe
  C:\Windows\System\AkdjGAK.exe
  2⤵
  PID:7176
- C:\Windows\System\igkzvVR.exe
  C:\Windows\System\igkzvVR.exe
  2⤵
  PID:7200
- C:\Windows\System\kXEMIqy.exe
  C:\Windows\System\kXEMIqy.exe
  2⤵
  PID:7220
- C:\Windows\System\CnbCyyM.exe
  C:\Windows\System\CnbCyyM.exe
  2⤵
  PID:7244
- C:\Windows\System\ceMvcus.exe
  C:\Windows\System\ceMvcus.exe
  2⤵
  PID:7268
- C:\Windows\System\mESbeZb.exe
  C:\Windows\System\mESbeZb.exe
  2⤵
  PID:7284
- C:\Windows\System\DgWBteS.exe
  C:\Windows\System\DgWBteS.exe
  2⤵
  PID:7332
- C:\Windows\System\OlAVOun.exe
  C:\Windows\System\OlAVOun.exe
  2⤵
  PID:7352
- C:\Windows\System\UNwDPjE.exe
  C:\Windows\System\UNwDPjE.exe
  2⤵
  PID:7400
- C:\Windows\System\FuhTmhT.exe
  C:\Windows\System\FuhTmhT.exe
  2⤵
  PID:7420
- C:\Windows\System\YCpNMqp.exe
  C:\Windows\System\YCpNMqp.exe
  2⤵
  PID:7440
- C:\Windows\System\ZBbaSku.exe
  C:\Windows\System\ZBbaSku.exe
  2⤵
  PID:7460
- C:\Windows\System\oTtyGEL.exe
  C:\Windows\System\oTtyGEL.exe
  2⤵
  PID:7476
- C:\Windows\System\SCCQBiL.exe
  C:\Windows\System\SCCQBiL.exe
  2⤵
  PID:7504
- C:\Windows\System\kfkJoUI.exe
  C:\Windows\System\kfkJoUI.exe
  2⤵
  PID:7532
- C:\Windows\System\llullil.exe
  C:\Windows\System\llullil.exe
  2⤵
  PID:7560
- C:\Windows\System\WaffwqA.exe
  C:\Windows\System\WaffwqA.exe
  2⤵
  PID:7596
- C:\Windows\System\wPtqxRP.exe
  C:\Windows\System\wPtqxRP.exe
  2⤵
  PID:7628
- C:\Windows\System\oZNXIjz.exe
  C:\Windows\System\oZNXIjz.exe
  2⤵
  PID:7648
- C:\Windows\System\TBrkEpS.exe
  C:\Windows\System\TBrkEpS.exe
  2⤵
  PID:7664
- C:\Windows\System\lLPqsAq.exe
  C:\Windows\System\lLPqsAq.exe
  2⤵
  PID:7684
- C:\Windows\System\YZZVsgq.exe
  C:\Windows\System\YZZVsgq.exe
  2⤵
  PID:7708
- C:\Windows\System\gcklyaO.exe
  C:\Windows\System\gcklyaO.exe
  2⤵
  PID:7736
- C:\Windows\System\FkVbEXz.exe
  C:\Windows\System\FkVbEXz.exe
  2⤵
  PID:7768
- C:\Windows\System\PPbVXBC.exe
  C:\Windows\System\PPbVXBC.exe
  2⤵
  PID:7848
- C:\Windows\System\kySMywA.exe
  C:\Windows\System\kySMywA.exe
  2⤵
  PID:7868
- C:\Windows\System\yYYGWeR.exe
  C:\Windows\System\yYYGWeR.exe
  2⤵
  PID:7900
- C:\Windows\System\ELgmJlu.exe
  C:\Windows\System\ELgmJlu.exe
  2⤵
  PID:7940
- C:\Windows\System\qqianpg.exe
  C:\Windows\System\qqianpg.exe
  2⤵
  PID:7956
- C:\Windows\System\Pjiascf.exe
  C:\Windows\System\Pjiascf.exe
  2⤵
  PID:7984
- C:\Windows\System\MxIOkYU.exe
  C:\Windows\System\MxIOkYU.exe
  2⤵
  PID:8000
- C:\Windows\System\aigGCGp.exe
  C:\Windows\System\aigGCGp.exe
  2⤵
  PID:8040
- C:\Windows\System\tmPUCPM.exe
  C:\Windows\System\tmPUCPM.exe
  2⤵
  PID:8056
- C:\Windows\System\Yhbfxra.exe
  C:\Windows\System\Yhbfxra.exe
  2⤵
  PID:8076
- C:\Windows\System\fydDRKw.exe
  C:\Windows\System\fydDRKw.exe
  2⤵
  PID:8096
- C:\Windows\System\gEWNdFL.exe
  C:\Windows\System\gEWNdFL.exe
  2⤵
  PID:8116
- C:\Windows\System\GCVOxos.exe
  C:\Windows\System\GCVOxos.exe
  2⤵
  PID:8136
- C:\Windows\System\OjnPvCV.exe
  C:\Windows\System\OjnPvCV.exe
  2⤵
  PID:8188
- C:\Windows\System\yvlSDvg.exe
  C:\Windows\System\yvlSDvg.exe
  2⤵
  PID:7196
- C:\Windows\System\tCVlfyX.exe
  C:\Windows\System\tCVlfyX.exe
  2⤵
  PID:7260
- C:\Windows\System\PHjnTpw.exe
  C:\Windows\System\PHjnTpw.exe
  2⤵
  PID:7256
- C:\Windows\System\pBlZXmf.exe
  C:\Windows\System\pBlZXmf.exe
  2⤵
  PID:7380
- C:\Windows\System\Aagqpgk.exe
  C:\Windows\System\Aagqpgk.exe
  2⤵
  PID:7456
- C:\Windows\System\dfwSYXx.exe
  C:\Windows\System\dfwSYXx.exe
  2⤵
  PID:7540
- C:\Windows\System\ojSjUKR.exe
  C:\Windows\System\ojSjUKR.exe
  2⤵
  PID:7608
- C:\Windows\System\kyAELEP.exe
  C:\Windows\System\kyAELEP.exe
  2⤵
  PID:7680
- C:\Windows\System\mpqLAqj.exe
  C:\Windows\System\mpqLAqj.exe
  2⤵
  PID:7784
- C:\Windows\System\VkEHiRx.exe
  C:\Windows\System\VkEHiRx.exe
  2⤵
  PID:7812
- C:\Windows\System\JuZRoIh.exe
  C:\Windows\System\JuZRoIh.exe
  2⤵
  PID:7888
- C:\Windows\System\nEQUifj.exe
  C:\Windows\System\nEQUifj.exe
  2⤵
  PID:7924
- C:\Windows\System\YBcTQpm.exe
  C:\Windows\System\YBcTQpm.exe
  2⤵
  PID:7972
- C:\Windows\System\DueZfZN.exe
  C:\Windows\System\DueZfZN.exe
  2⤵
  PID:8020
- C:\Windows\System\CdsXeXc.exe
  C:\Windows\System\CdsXeXc.exe
  2⤵
  PID:8132
- C:\Windows\System\DhUhViG.exe
  C:\Windows\System\DhUhViG.exe
  2⤵
  PID:7216
- C:\Windows\System\toSxzzu.exe
  C:\Windows\System\toSxzzu.exe
  2⤵
  PID:7408
- C:\Windows\System\PEFCJDZ.exe
  C:\Windows\System\PEFCJDZ.exe
  2⤵
  PID:7492
- C:\Windows\System\YmSUyMV.exe
  C:\Windows\System\YmSUyMV.exe
  2⤵
  PID:7584
- C:\Windows\System\dGEetee.exe
  C:\Windows\System\dGEetee.exe
  2⤵
  PID:2312
- C:\Windows\System\bAYvlzZ.exe
  C:\Windows\System\bAYvlzZ.exe
  2⤵
  PID:7920
- C:\Windows\System\wMAmRCw.exe
  C:\Windows\System\wMAmRCw.exe
  2⤵
  PID:8128
- C:\Windows\System\cUdxoGE.exe
  C:\Windows\System\cUdxoGE.exe
  2⤵
  PID:8152
- C:\Windows\System\hjQlyLK.exe
  C:\Windows\System\hjQlyLK.exe
  2⤵
  PID:4712
- C:\Windows\System\MmflMpQ.exe
  C:\Windows\System\MmflMpQ.exe
  2⤵
  PID:7804
- C:\Windows\System\eXVgLrc.exe
  C:\Windows\System\eXVgLrc.exe
  2⤵
  PID:8088
- C:\Windows\System\PFquqgi.exe
  C:\Windows\System\PFquqgi.exe
  2⤵
  PID:7676
- C:\Windows\System\PNMdzIE.exe
  C:\Windows\System\PNMdzIE.exe
  2⤵
  PID:8200
- C:\Windows\System\hrVcQIA.exe
  C:\Windows\System\hrVcQIA.exe
  2⤵
  PID:8220
- C:\Windows\System\DvLudPf.exe
  C:\Windows\System\DvLudPf.exe
  2⤵
  PID:8248
- C:\Windows\System\DqzlAPy.exe
  C:\Windows\System\DqzlAPy.exe
  2⤵
  PID:8272
- C:\Windows\System\qzQyCcC.exe
  C:\Windows\System\qzQyCcC.exe
  2⤵
  PID:8296
- C:\Windows\System\gFRyNLi.exe
  C:\Windows\System\gFRyNLi.exe
  2⤵
  PID:8328
- C:\Windows\System\bmFcFSk.exe
  C:\Windows\System\bmFcFSk.exe
  2⤵
  PID:8368
- C:\Windows\System\olrKWTg.exe
  C:\Windows\System\olrKWTg.exe
  2⤵
  PID:8384
- C:\Windows\System\WtRdqVu.exe
  C:\Windows\System\WtRdqVu.exe
  2⤵
  PID:8408
- C:\Windows\System\tJEhGMX.exe
  C:\Windows\System\tJEhGMX.exe
  2⤵
  PID:8432
- C:\Windows\System\fSMlvLa.exe
  C:\Windows\System\fSMlvLa.exe
  2⤵
  PID:8452
- C:\Windows\System\VgYbqeQ.exe
  C:\Windows\System\VgYbqeQ.exe
  2⤵
  PID:8508
- C:\Windows\System\KlRuuGj.exe
  C:\Windows\System\KlRuuGj.exe
  2⤵
  PID:8528
- C:\Windows\System\oZtLUuS.exe
  C:\Windows\System\oZtLUuS.exe
  2⤵
  PID:8548
- C:\Windows\System\mEGwVYw.exe
  C:\Windows\System\mEGwVYw.exe
  2⤵
  PID:8584
- C:\Windows\System\SyZuEqo.exe
  C:\Windows\System\SyZuEqo.exe
  2⤵
  PID:8608
- C:\Windows\System\KnGScLu.exe
  C:\Windows\System\KnGScLu.exe
  2⤵
  PID:8624
- C:\Windows\System\qzsEkMt.exe
  C:\Windows\System\qzsEkMt.exe
  2⤵
  PID:8648
- C:\Windows\System\iphKAva.exe
  C:\Windows\System\iphKAva.exe
  2⤵
  PID:8672
- C:\Windows\System\tUzEMaz.exe
  C:\Windows\System\tUzEMaz.exe
  2⤵
  PID:8696
- C:\Windows\System\DSFumim.exe
  C:\Windows\System\DSFumim.exe
  2⤵
  PID:8720
- C:\Windows\System\aAXMxGF.exe
  C:\Windows\System\aAXMxGF.exe
  2⤵
  PID:8752
- C:\Windows\System\CBTFJnH.exe
  C:\Windows\System\CBTFJnH.exe
  2⤵
  PID:8804
- C:\Windows\System\mLQPDmv.exe
  C:\Windows\System\mLQPDmv.exe
  2⤵
  PID:8820
- C:\Windows\System\FelnBCt.exe
  C:\Windows\System\FelnBCt.exe
  2⤵
  PID:8844
- C:\Windows\System\MMJTfJU.exe
  C:\Windows\System\MMJTfJU.exe
  2⤵
  PID:8876
- C:\Windows\System\VOcjQGd.exe
  C:\Windows\System\VOcjQGd.exe
  2⤵
  PID:8940
- C:\Windows\System\NOjVbmq.exe
  C:\Windows\System\NOjVbmq.exe
  2⤵
  PID:8956
- C:\Windows\System\FsfQZrU.exe
  C:\Windows\System\FsfQZrU.exe
  2⤵
  PID:8980
- C:\Windows\System\XMdgijV.exe
  C:\Windows\System\XMdgijV.exe
  2⤵
  PID:9004
- C:\Windows\System\AiZIGpI.exe
  C:\Windows\System\AiZIGpI.exe
  2⤵
  PID:9028
- C:\Windows\System\JPSPFFK.exe
  C:\Windows\System\JPSPFFK.exe
  2⤵
  PID:9056
- C:\Windows\System\FFrKRlS.exe
  C:\Windows\System\FFrKRlS.exe
  2⤵
  PID:9080
- C:\Windows\System\WrUXQCF.exe
  C:\Windows\System\WrUXQCF.exe
  2⤵
  PID:9100
- C:\Windows\System\gDWNAOn.exe
  C:\Windows\System\gDWNAOn.exe
  2⤵
  PID:9124
- C:\Windows\System\takvuKP.exe
  C:\Windows\System\takvuKP.exe
  2⤵
  PID:9152
- C:\Windows\System\WapsAGW.exe
  C:\Windows\System\WapsAGW.exe
  2⤵
  PID:9168
- C:\Windows\System\PrzdjcN.exe
  C:\Windows\System\PrzdjcN.exe
  2⤵
  PID:9192
- C:\Windows\System\DNABohc.exe
  C:\Windows\System\DNABohc.exe
  2⤵
  PID:9208
- C:\Windows\System\zCFjGxl.exe
  C:\Windows\System\zCFjGxl.exe
  2⤵
  PID:7968
- C:\Windows\System\TwiLBYM.exe
  C:\Windows\System\TwiLBYM.exe
  2⤵
  PID:8312
- C:\Windows\System\RZTqvGg.exe
  C:\Windows\System\RZTqvGg.exe
  2⤵
  PID:8440
- C:\Windows\System\AKeJwIY.exe
  C:\Windows\System\AKeJwIY.exe
  2⤵
  PID:8500
- C:\Windows\System\oWUorby.exe
  C:\Windows\System\oWUorby.exe
  2⤵
  PID:8576
- C:\Windows\System\OfpdTLG.exe
  C:\Windows\System\OfpdTLG.exe
  2⤵
  PID:8620
- C:\Windows\System\mkBgyyo.exe
  C:\Windows\System\mkBgyyo.exe
  2⤵
  PID:8692
- C:\Windows\System\KzEYbLW.exe
  C:\Windows\System\KzEYbLW.exe
  2⤵
  PID:8708
- C:\Windows\System\WTVuGhH.exe
  C:\Windows\System\WTVuGhH.exe
  2⤵
  PID:8836
- C:\Windows\System\YXZEhIf.exe
  C:\Windows\System\YXZEhIf.exe
  2⤵
  PID:8936
- C:\Windows\System\lNBwUQY.exe
  C:\Windows\System\lNBwUQY.exe
  2⤵
  PID:8948
- C:\Windows\System\hKYBDjq.exe
  C:\Windows\System\hKYBDjq.exe
  2⤵
  PID:9040
- C:\Windows\System\eywfDur.exe
  C:\Windows\System\eywfDur.exe
  2⤵
  PID:9108
- C:\Windows\System\miZIfhc.exe
  C:\Windows\System\miZIfhc.exe
  2⤵
  PID:9148
- C:\Windows\System\WjZZunO.exe
  C:\Windows\System\WjZZunO.exe
  2⤵
  PID:8284
- C:\Windows\System\GDhhlah.exe
  C:\Windows\System\GDhhlah.exe
  2⤵
  PID:8356
- C:\Windows\System\SKibClj.exe
  C:\Windows\System\SKibClj.exe
  2⤵
  PID:8404
- C:\Windows\System\DzBQOrR.exe
  C:\Windows\System\DzBQOrR.exe
  2⤵
  PID:8540
- C:\Windows\System\lnxGvzN.exe
  C:\Windows\System\lnxGvzN.exe
  2⤵
  PID:8796
- C:\Windows\System\rfilqIR.exe
  C:\Windows\System\rfilqIR.exe
  2⤵
  PID:8908
- C:\Windows\System\JmxDvRV.exe
  C:\Windows\System\JmxDvRV.exe
  2⤵
  PID:8156
- C:\Windows\System\NyEfXIK.exe
  C:\Windows\System\NyEfXIK.exe
  2⤵
  PID:8636
- C:\Windows\System\lqujsnf.exe
  C:\Windows\System\lqujsnf.exe
  2⤵
  PID:8544
- C:\Windows\System\kLfuIrp.exe
  C:\Windows\System\kLfuIrp.exe
  2⤵
  PID:9048
- C:\Windows\System\wAelTkG.exe
  C:\Windows\System\wAelTkG.exe
  2⤵
  PID:9204
- C:\Windows\System\zooJOzZ.exe
  C:\Windows\System\zooJOzZ.exe
  2⤵
  PID:9248
- C:\Windows\System\OWasmEs.exe
  C:\Windows\System\OWasmEs.exe
  2⤵
  PID:9272
- C:\Windows\System\ihqXYVI.exe
  C:\Windows\System\ihqXYVI.exe
  2⤵
  PID:9304
- C:\Windows\System\uaagDlT.exe
  C:\Windows\System\uaagDlT.exe
  2⤵
  PID:9324
- C:\Windows\System\eFaCclo.exe
  C:\Windows\System\eFaCclo.exe
  2⤵
  PID:9348
- C:\Windows\System\jwnWVUY.exe
  C:\Windows\System\jwnWVUY.exe
  2⤵
  PID:9376
- C:\Windows\System\fvjUtnF.exe
  C:\Windows\System\fvjUtnF.exe
  2⤵
  PID:9416
- C:\Windows\System\DLQPqDx.exe
  C:\Windows\System\DLQPqDx.exe
  2⤵
  PID:9440
- C:\Windows\System\hKonbGt.exe
  C:\Windows\System\hKonbGt.exe
  2⤵
  PID:9460
- C:\Windows\System\qTYDNPJ.exe
  C:\Windows\System\qTYDNPJ.exe
  2⤵
  PID:9500
- C:\Windows\System\jxUwBuH.exe
  C:\Windows\System\jxUwBuH.exe
  2⤵
  PID:9524
- C:\Windows\System\bWUFkSA.exe
  C:\Windows\System\bWUFkSA.exe
  2⤵
  PID:9544
- C:\Windows\System\REVvRTn.exe
  C:\Windows\System\REVvRTn.exe
  2⤵
  PID:9564
- C:\Windows\System\ChSeYgt.exe
  C:\Windows\System\ChSeYgt.exe
  2⤵
  PID:9588
- C:\Windows\System\jqXXYHP.exe
  C:\Windows\System\jqXXYHP.exe
  2⤵
  PID:9628
- C:\Windows\System\VovnVes.exe
  C:\Windows\System\VovnVes.exe
  2⤵
  PID:9668
- C:\Windows\System\KoDoLsy.exe
  C:\Windows\System\KoDoLsy.exe
  2⤵
  PID:9688
- C:\Windows\System\lkkFHqq.exe
  C:\Windows\System\lkkFHqq.exe
  2⤵
  PID:9704
- C:\Windows\System\roLYols.exe
  C:\Windows\System\roLYols.exe
  2⤵
  PID:9748
- C:\Windows\System\FFXEOlL.exe
  C:\Windows\System\FFXEOlL.exe
  2⤵
  PID:9772
- C:\Windows\System\DzXnxaa.exe
  C:\Windows\System\DzXnxaa.exe
  2⤵
  PID:9812
- C:\Windows\System\KCiykut.exe
  C:\Windows\System\KCiykut.exe
  2⤵
  PID:9832
- C:\Windows\System\eVBEMdi.exe
  C:\Windows\System\eVBEMdi.exe
  2⤵
  PID:9856
- C:\Windows\System\LWsALaS.exe
  C:\Windows\System\LWsALaS.exe
  2⤵
  PID:9884
- C:\Windows\System\YgMJjEC.exe
  C:\Windows\System\YgMJjEC.exe
  2⤵
  PID:9904
- C:\Windows\System\KTiYqWq.exe
  C:\Windows\System\KTiYqWq.exe
  2⤵
  PID:9928
- C:\Windows\System\FqoWPeY.exe
  C:\Windows\System\FqoWPeY.exe
  2⤵
  PID:9948
- C:\Windows\System\dhyQdgT.exe
  C:\Windows\System\dhyQdgT.exe
  2⤵
  PID:9980
- C:\Windows\System\LItjwjQ.exe
  C:\Windows\System\LItjwjQ.exe
  2⤵
  PID:10036
- C:\Windows\System\NVVtgXC.exe
  C:\Windows\System\NVVtgXC.exe
  2⤵
  PID:10056
- C:\Windows\System\WNfgQSO.exe
  C:\Windows\System\WNfgQSO.exe
  2⤵
  PID:10080
- C:\Windows\System\bHLcEmh.exe
  C:\Windows\System\bHLcEmh.exe
  2⤵
  PID:10096
- C:\Windows\System\TzWPZgX.exe
  C:\Windows\System\TzWPZgX.exe
  2⤵
  PID:10116
- C:\Windows\System\dgsERpp.exe
  C:\Windows\System\dgsERpp.exe
  2⤵
  PID:10148
- C:\Windows\System\evAwnTA.exe
  C:\Windows\System\evAwnTA.exe
  2⤵
  PID:10176
- C:\Windows\System\YCIwmRV.exe
  C:\Windows\System\YCIwmRV.exe
  2⤵
  PID:10208
- C:\Windows\System\agLKnAV.exe
  C:\Windows\System\agLKnAV.exe
  2⤵
  PID:10232
- C:\Windows\System\phNGXEP.exe
  C:\Windows\System\phNGXEP.exe
  2⤵
  PID:8316
- C:\Windows\System\GjhSftY.exe
  C:\Windows\System\GjhSftY.exe
  2⤵
  PID:9320
- C:\Windows\System\onBidoO.exe
  C:\Windows\System\onBidoO.exe
  2⤵
  PID:9368
- C:\Windows\System\ceHcsua.exe
  C:\Windows\System\ceHcsua.exe
  2⤵
  PID:9448
- C:\Windows\System\yzwhQGz.exe
  C:\Windows\System\yzwhQGz.exe
  2⤵
  PID:9492
- C:\Windows\System\hdICHkX.exe
  C:\Windows\System\hdICHkX.exe
  2⤵
  PID:9556
- C:\Windows\System\jBmyYSC.exe
  C:\Windows\System\jBmyYSC.exe
  2⤵
  PID:9576
- C:\Windows\System\YwUQdrt.exe
  C:\Windows\System\YwUQdrt.exe
  2⤵
  PID:9680
- C:\Windows\System\xoHnQpt.exe
  C:\Windows\System\xoHnQpt.exe
  2⤵
  PID:9764
- C:\Windows\System\oZCxfsG.exe
  C:\Windows\System\oZCxfsG.exe
  2⤵
  PID:9876
- C:\Windows\System\WtszlzO.exe
  C:\Windows\System\WtszlzO.exe
  2⤵
  PID:9916
- C:\Windows\System\gTEXASD.exe
  C:\Windows\System\gTEXASD.exe
  2⤵
  PID:9988
- C:\Windows\System\qwAGddM.exe
  C:\Windows\System\qwAGddM.exe
  2⤵
  PID:10072
- C:\Windows\System\NHawnJN.exe
  C:\Windows\System\NHawnJN.exe
  2⤵
  PID:10088
- C:\Windows\System\zPlhOXp.exe
  C:\Windows\System\zPlhOXp.exe
  2⤵
  PID:10228
- C:\Windows\System\pbbYoCt.exe
  C:\Windows\System\pbbYoCt.exe
  2⤵
  PID:9184
- C:\Windows\System\lPbLhiz.exe
  C:\Windows\System\lPbLhiz.exe
  2⤵
  PID:9400
- C:\Windows\System\oNSoXiM.exe
  C:\Windows\System\oNSoXiM.exe
  2⤵
  PID:9532
- C:\Windows\System\SXOKiZe.exe
  C:\Windows\System\SXOKiZe.exe
  2⤵
  PID:9656
- C:\Windows\System\TGGumrZ.exe
  C:\Windows\System\TGGumrZ.exe
  2⤵
  PID:9676
- C:\Windows\System\HTbSTJt.exe
  C:\Windows\System\HTbSTJt.exe
  2⤵
  PID:9840
- C:\Windows\System\jsTsUPK.exe
  C:\Windows\System\jsTsUPK.exe
  2⤵
  PID:10136
- C:\Windows\System\PjaPhey.exe
  C:\Windows\System\PjaPhey.exe
  2⤵
  PID:9372
- C:\Windows\System\lEBvNXu.exe
  C:\Windows\System\lEBvNXu.exe
  2⤵
  PID:9756
- C:\Windows\System\vggaQIv.exe
  C:\Windows\System\vggaQIv.exe
  2⤵
  PID:9944
- C:\Windows\System\eueXDYJ.exe
  C:\Windows\System\eueXDYJ.exe
  2⤵
  PID:9696
- C:\Windows\System\rERKjcb.exe
  C:\Windows\System\rERKjcb.exe
  2⤵
  PID:10244
- C:\Windows\System\hBCEPdu.exe
  C:\Windows\System\hBCEPdu.exe
  2⤵
  PID:10296
- C:\Windows\System\LJZNKdr.exe
  C:\Windows\System\LJZNKdr.exe
  2⤵
  PID:10324
- C:\Windows\System\jVoUHOF.exe
  C:\Windows\System\jVoUHOF.exe
  2⤵
  PID:10344
- C:\Windows\System\emzEHdu.exe
  C:\Windows\System\emzEHdu.exe
  2⤵
  PID:10364
- C:\Windows\System\XWpCADC.exe
  C:\Windows\System\XWpCADC.exe
  2⤵
  PID:10384
- C:\Windows\System\VBwsONO.exe
  C:\Windows\System\VBwsONO.exe
  2⤵
  PID:10412
- C:\Windows\System\wTKJvWh.exe
  C:\Windows\System\wTKJvWh.exe
  2⤵
  PID:10432
- C:\Windows\System\rfdTBGU.exe
  C:\Windows\System\rfdTBGU.exe
  2⤵
  PID:10452
- C:\Windows\System\jgiOIiu.exe
  C:\Windows\System\jgiOIiu.exe
  2⤵
  PID:10476
- C:\Windows\System\zlJxnMy.exe
  C:\Windows\System\zlJxnMy.exe
  2⤵
  PID:10492
- C:\Windows\System\JOvdqsx.exe
  C:\Windows\System\JOvdqsx.exe
  2⤵
  PID:10532
- C:\Windows\System\oGRsMHw.exe
  C:\Windows\System\oGRsMHw.exe
  2⤵
  PID:10560
- C:\Windows\System\mbuiynR.exe
  C:\Windows\System\mbuiynR.exe
  2⤵
  PID:10596
- C:\Windows\System\uuORQZN.exe
  C:\Windows\System\uuORQZN.exe
  2⤵
  PID:10620
- C:\Windows\System\RUBrsAN.exe
  C:\Windows\System\RUBrsAN.exe
  2⤵
  PID:10640
- C:\Windows\System\FMoGSVK.exe
  C:\Windows\System\FMoGSVK.exe
  2⤵
  PID:10676
- C:\Windows\System\NwWkCBv.exe
  C:\Windows\System\NwWkCBv.exe
  2⤵
  PID:10732
- C:\Windows\System\ElNMnqa.exe
  C:\Windows\System\ElNMnqa.exe
  2⤵
  PID:10748
- C:\Windows\System\DosEUXj.exe
  C:\Windows\System\DosEUXj.exe
  2⤵
  PID:10772
- C:\Windows\System\KKJzSLf.exe
  C:\Windows\System\KKJzSLf.exe
  2⤵
  PID:10800
- C:\Windows\System\yoWmHsF.exe
  C:\Windows\System\yoWmHsF.exe
  2⤵
  PID:10824
- C:\Windows\System\EtYGohf.exe
  C:\Windows\System\EtYGohf.exe
  2⤵
  PID:10872
- C:\Windows\System\LiRsBoN.exe
  C:\Windows\System\LiRsBoN.exe
  2⤵
  PID:10896
- C:\Windows\System\aawIMCF.exe
  C:\Windows\System\aawIMCF.exe
  2⤵
  PID:10916
- C:\Windows\System\hUqymKh.exe
  C:\Windows\System\hUqymKh.exe
  2⤵
  PID:10932
- C:\Windows\System\sWQOHAq.exe
  C:\Windows\System\sWQOHAq.exe
  2⤵
  PID:10972
- C:\Windows\System\eEvsTOk.exe
  C:\Windows\System\eEvsTOk.exe
  2⤵
  PID:11000
- C:\Windows\System\wjxYmAf.exe
  C:\Windows\System\wjxYmAf.exe
  2⤵
  PID:11040
- C:\Windows\System\FptveQr.exe
  C:\Windows\System\FptveQr.exe
  2⤵
  PID:11064
- C:\Windows\System\cMdAGig.exe
  C:\Windows\System\cMdAGig.exe
  2⤵
  PID:11108
- C:\Windows\System\BMfUIsQ.exe
  C:\Windows\System\BMfUIsQ.exe
  2⤵
  PID:11136
- C:\Windows\System\DMLZmgt.exe
  C:\Windows\System\DMLZmgt.exe
  2⤵
  PID:11152
- C:\Windows\System\ouQnRua.exe
  C:\Windows\System\ouQnRua.exe
  2⤵
  PID:11172
- C:\Windows\System\DRRxIdQ.exe
  C:\Windows\System\DRRxIdQ.exe
  2⤵
  PID:11208
- C:\Windows\System\CqCyvoD.exe
  C:\Windows\System\CqCyvoD.exe
  2⤵
  PID:11228
- C:\Windows\System\bBKiTOX.exe
  C:\Windows\System\bBKiTOX.exe
  2⤵
  PID:11244
- C:\Windows\System\HRkpMrw.exe
  C:\Windows\System\HRkpMrw.exe
  2⤵
  PID:9724
- C:\Windows\System\SxRtYRx.exe
  C:\Windows\System\SxRtYRx.exe
  2⤵
  PID:10272
- C:\Windows\System\JmvzxyP.exe
  C:\Windows\System\JmvzxyP.exe
  2⤵
  PID:10336
- C:\Windows\System\IKWrFbd.exe
  C:\Windows\System\IKWrFbd.exe
  2⤵
  PID:10376
- C:\Windows\System\OlzbvIZ.exe
  C:\Windows\System\OlzbvIZ.exe
  2⤵
  PID:10468
- C:\Windows\System\nNJJSUq.exe
  C:\Windows\System\nNJJSUq.exe
  2⤵
  PID:10484
- C:\Windows\System\MqdDagI.exe
  C:\Windows\System\MqdDagI.exe
  2⤵
  PID:10592
- C:\Windows\System\DEyRzmh.exe
  C:\Windows\System\DEyRzmh.exe
  2⤵
  PID:10740
- C:\Windows\System\aEEeZWv.exe
  C:\Windows\System\aEEeZWv.exe
  2⤵
  PID:10788
- C:\Windows\System\DbBxmwI.exe
  C:\Windows\System\DbBxmwI.exe
  2⤵
  PID:10816
- C:\Windows\System\djhkgBi.exe
  C:\Windows\System\djhkgBi.exe
  2⤵
  PID:10888
- C:\Windows\System\HemSIMD.exe
  C:\Windows\System\HemSIMD.exe
  2⤵
  PID:10928
- C:\Windows\System\BRHlfDZ.exe
  C:\Windows\System\BRHlfDZ.exe
  2⤵
  PID:11032
- C:\Windows\System\HScVBEI.exe
  C:\Windows\System\HScVBEI.exe
  2⤵
  PID:11092
- C:\Windows\System\YGClXjA.exe
  C:\Windows\System\YGClXjA.exe
  2⤵
  PID:11128
- C:\Windows\System\njgPDJm.exe
  C:\Windows\System\njgPDJm.exe
  2⤵
  PID:11236
- C:\Windows\System\lTCNGxG.exe
  C:\Windows\System\lTCNGxG.exe
  2⤵
  PID:11260
- C:\Windows\System\qlchNJZ.exe
  C:\Windows\System\qlchNJZ.exe
  2⤵
  PID:10380
- C:\Windows\System\LrYIzoa.exe
  C:\Windows\System\LrYIzoa.exe
  2⤵
  PID:10528
- C:\Windows\System\xahXfNu.exe
  C:\Windows\System\xahXfNu.exe
  2⤵
  PID:10664
- C:\Windows\System\xSVxnrj.exe
  C:\Windows\System\xSVxnrj.exe
  2⤵
  PID:10836
- C:\Windows\System\pKyqqQz.exe
  C:\Windows\System\pKyqqQz.exe
  2⤵
  PID:10924
- C:\Windows\System\Ozodpkt.exe
  C:\Windows\System\Ozodpkt.exe
  2⤵
  PID:11164
- C:\Windows\System\FvDfdlq.exe
  C:\Windows\System\FvDfdlq.exe
  2⤵
  PID:10544
- C:\Windows\System\NmDjKPY.exe
  C:\Windows\System\NmDjKPY.exe
  2⤵
  PID:10768
- C:\Windows\System\UcJxkNQ.exe
  C:\Windows\System\UcJxkNQ.exe
  2⤵
  PID:10904
- C:\Windows\System\tBCGsfI.exe
  C:\Windows\System\tBCGsfI.exe
  2⤵
  PID:11104
- C:\Windows\System\ESjJkPG.exe
  C:\Windows\System\ESjJkPG.exe
  2⤵
  PID:11268
- C:\Windows\System\VLoVTzh.exe
  C:\Windows\System\VLoVTzh.exe
  2⤵
  PID:11284
- C:\Windows\System\XYtDQgi.exe
  C:\Windows\System\XYtDQgi.exe
  2⤵
  PID:11300
- C:\Windows\System\uKNXGuM.exe
  C:\Windows\System\uKNXGuM.exe
  2⤵
  PID:11324
- C:\Windows\System\NplUqXB.exe
  C:\Windows\System\NplUqXB.exe
  2⤵
  PID:11384
- C:\Windows\System\vEOPGrC.exe
  C:\Windows\System\vEOPGrC.exe
  2⤵
  PID:11400
- C:\Windows\System\JswJKJh.exe
  C:\Windows\System\JswJKJh.exe
  2⤵
  PID:11432
- C:\Windows\System\VHXioyX.exe
  C:\Windows\System\VHXioyX.exe
  2⤵
  PID:11456
- C:\Windows\System\GssKZYr.exe
  C:\Windows\System\GssKZYr.exe
  2⤵
  PID:11476
- C:\Windows\System\qwkRNVk.exe
  C:\Windows\System\qwkRNVk.exe
  2⤵
  PID:11520
- C:\Windows\System\FPUzKCr.exe
  C:\Windows\System\FPUzKCr.exe
  2⤵
  PID:11536
- C:\Windows\System\pstsMKU.exe
  C:\Windows\System\pstsMKU.exe
  2⤵
  PID:11556
- C:\Windows\System\uDjTKKu.exe
  C:\Windows\System\uDjTKKu.exe
  2⤵
  PID:11576
- C:\Windows\System\mlNJdQP.exe
  C:\Windows\System\mlNJdQP.exe
  2⤵
  PID:11604
- C:\Windows\System\QpQmIie.exe
  C:\Windows\System\QpQmIie.exe
  2⤵
  PID:11624
- C:\Windows\System\iuMAPHm.exe
  C:\Windows\System\iuMAPHm.exe
  2⤵
  PID:11668
- C:\Windows\System\whPAngR.exe
  C:\Windows\System\whPAngR.exe
  2⤵
  PID:11704
- C:\Windows\System\esEHKiF.exe
  C:\Windows\System\esEHKiF.exe
  2⤵
  PID:11732
- C:\Windows\System\ndTzmDe.exe
  C:\Windows\System\ndTzmDe.exe
  2⤵
  PID:11764
- C:\Windows\System\FBAzFtg.exe
  C:\Windows\System\FBAzFtg.exe
  2⤵
  PID:11784
- C:\Windows\System\CeAQYey.exe
  C:\Windows\System\CeAQYey.exe
  2⤵
  PID:11812
- C:\Windows\System\RomZaob.exe
  C:\Windows\System\RomZaob.exe
  2⤵
  PID:11832
- C:\Windows\System\wGBsPEe.exe
  C:\Windows\System\wGBsPEe.exe
  2⤵
  PID:11856
- C:\Windows\System\wWNBcJy.exe
  C:\Windows\System\wWNBcJy.exe
  2⤵
  PID:11924
- C:\Windows\System\LkSOQmm.exe
  C:\Windows\System\LkSOQmm.exe
  2⤵
  PID:11940
- C:\Windows\System\sBHZJcB.exe
  C:\Windows\System\sBHZJcB.exe
  2⤵
  PID:11964
- C:\Windows\System\TVQtCoe.exe
  C:\Windows\System\TVQtCoe.exe
  2⤵
  PID:11988
- C:\Windows\System\qcNAjCi.exe
  C:\Windows\System\qcNAjCi.exe
  2⤵
  PID:12024
- C:\Windows\System\oiJUBlC.exe
  C:\Windows\System\oiJUBlC.exe
  2⤵
  PID:12040
- C:\Windows\System\zxKrmox.exe
  C:\Windows\System\zxKrmox.exe
  2⤵
  PID:12060
- C:\Windows\System\KIDWYMA.exe
  C:\Windows\System\KIDWYMA.exe
  2⤵
  PID:12080
- C:\Windows\System\bXbZKwB.exe
  C:\Windows\System\bXbZKwB.exe
  2⤵
  PID:12120
- C:\Windows\System\JPXQdoa.exe
  C:\Windows\System\JPXQdoa.exe
  2⤵
  PID:12144
- C:\Windows\System\IgyCJgx.exe
  C:\Windows\System\IgyCJgx.exe
  2⤵
  PID:12204
- C:\Windows\System\LtIHNjW.exe
  C:\Windows\System\LtIHNjW.exe
  2⤵
  PID:12232
- C:\Windows\System\IWWSWYi.exe
  C:\Windows\System\IWWSWYi.exe
  2⤵
  PID:12248
- C:\Windows\System\XwEVDAH.exe
  C:\Windows\System\XwEVDAH.exe
  2⤵
  PID:12268
- C:\Windows\System\LCJQHcC.exe
  C:\Windows\System\LCJQHcC.exe
  2⤵
  PID:10356
- C:\Windows\System\dmdscVF.exe
  C:\Windows\System\dmdscVF.exe
  2⤵
  PID:11316
- C:\Windows\System\UvSQZet.exe
  C:\Windows\System\UvSQZet.exe
  2⤵
  PID:11396
- C:\Windows\System\yyNXdGJ.exe
  C:\Windows\System\yyNXdGJ.exe
  2⤵
  PID:11464
- C:\Windows\System\TFJlWVd.exe
  C:\Windows\System\TFJlWVd.exe
  2⤵
  PID:11528
- C:\Windows\System\MbUGDjI.exe
  C:\Windows\System\MbUGDjI.exe
  2⤵
  PID:11592
- C:\Windows\System\xNAOasa.exe
  C:\Windows\System\xNAOasa.exe
  2⤵
  PID:11676
- C:\Windows\System\veqMNUT.exe
  C:\Windows\System\veqMNUT.exe
  2⤵
  PID:11692
- C:\Windows\System\EoJOPxs.exe
  C:\Windows\System\EoJOPxs.exe
  2⤵
  PID:11724
- C:\Windows\System\yuZRBag.exe
  C:\Windows\System\yuZRBag.exe
  2⤵
  PID:11804
- C:\Windows\System\npIXMhs.exe
  C:\Windows\System\npIXMhs.exe
  2⤵
  PID:11952
- C:\Windows\System\ronTrpE.exe
  C:\Windows\System\ronTrpE.exe
  2⤵
  PID:11996
- C:\Windows\System\xFVSKvj.exe
  C:\Windows\System\xFVSKvj.exe
  2⤵
  PID:12016
- C:\Windows\System\gJYofsj.exe
  C:\Windows\System\gJYofsj.exe
  2⤵
  PID:12076
- C:\Windows\System\lSatccV.exe
  C:\Windows\System\lSatccV.exe
  2⤵
  PID:12176
- C:\Windows\System\TbvKOVi.exe
  C:\Windows\System\TbvKOVi.exe
  2⤵
  PID:12228
- C:\Windows\System\cPbKfpi.exe
  C:\Windows\System\cPbKfpi.exe
  2⤵
  PID:11280
- C:\Windows\System\WFRxIIg.exe
  C:\Windows\System\WFRxIIg.exe
  2⤵
  PID:12284
- C:\Windows\System\iVYJZwf.exe
  C:\Windows\System\iVYJZwf.exe
  2⤵
  PID:11616
- C:\Windows\System\VLTOscQ.exe
  C:\Windows\System\VLTOscQ.exe
  2⤵
  PID:11796
- C:\Windows\System\pIEYcuJ.exe
  C:\Windows\System\pIEYcuJ.exe
  2⤵
  PID:11896
- C:\Windows\System\scGPCYU.exe
  C:\Windows\System\scGPCYU.exe
  2⤵
  PID:12012
- C:\Windows\System\yDzwfia.exe
  C:\Windows\System\yDzwfia.exe
  2⤵
  PID:12256
- C:\Windows\System\OTufuBV.exe
  C:\Windows\System\OTufuBV.exe
  2⤵
  PID:11512
- C:\Windows\System\icSzZSm.exe
  C:\Windows\System\icSzZSm.exe
  2⤵
  PID:11864
- C:\Windows\System\fZpqlBC.exe
  C:\Windows\System\fZpqlBC.exe
  2⤵
  PID:12244
- C:\Windows\System\YHnNAMO.exe
  C:\Windows\System\YHnNAMO.exe
  2⤵
  PID:11416
- C:\Windows\System\bSsHFNd.exe
  C:\Windows\System\bSsHFNd.exe
  2⤵
  PID:12296
- C:\Windows\System\rDRNXgd.exe
  C:\Windows\System\rDRNXgd.exe
  2⤵
  PID:12312
- C:\Windows\System\JymNcln.exe
  C:\Windows\System\JymNcln.exe
  2⤵
  PID:12372
- C:\Windows\System\zNuleCI.exe
  C:\Windows\System\zNuleCI.exe
  2⤵
  PID:12396
- C:\Windows\System\FQndXOL.exe
  C:\Windows\System\FQndXOL.exe
  2⤵
  PID:12412
- C:\Windows\System\ItkgehN.exe
  C:\Windows\System\ItkgehN.exe
  2⤵
  PID:12428
- C:\Windows\System\yocZbMG.exe
  C:\Windows\System\yocZbMG.exe
  2⤵
  PID:12452
- C:\Windows\System\eHUIHBF.exe
  C:\Windows\System\eHUIHBF.exe
  2⤵
  PID:12484
- C:\Windows\System\PjHXMLM.exe
  C:\Windows\System\PjHXMLM.exe
  2⤵
  PID:12504
- C:\Windows\System\MlYqmYu.exe
  C:\Windows\System\MlYqmYu.exe
  2⤵
  PID:12524
- C:\Windows\System\SwHPMve.exe
  C:\Windows\System\SwHPMve.exe
  2⤵
  PID:12552
- C:\Windows\System\bnKLxjR.exe
  C:\Windows\System\bnKLxjR.exe
  2⤵
  PID:12576
- C:\Windows\System\YHCqGzY.exe
  C:\Windows\System\YHCqGzY.exe
  2⤵
  PID:12604
- C:\Windows\System\uWJVaiH.exe
  C:\Windows\System\uWJVaiH.exe
  2⤵
  PID:12620
- C:\Windows\System\kyaOQGF.exe
  C:\Windows\System\kyaOQGF.exe
  2⤵
  PID:12672
- C:\Windows\System\ATppQnC.exe
  C:\Windows\System\ATppQnC.exe
  2⤵
  PID:12740
- C:\Windows\System\lsaZISp.exe
  C:\Windows\System\lsaZISp.exe
  2⤵
  PID:12760
- C:\Windows\System\UrWthSc.exe
  C:\Windows\System\UrWthSc.exe
  2⤵
  PID:12776
- C:\Windows\System\CxTines.exe
  C:\Windows\System\CxTines.exe
  2⤵
  PID:12804
- C:\Windows\System\wAjcBih.exe
  C:\Windows\System\wAjcBih.exe
  2⤵
  PID:12828
- C:\Windows\System\TitphSH.exe
  C:\Windows\System\TitphSH.exe
  2⤵
  PID:12872
- C:\Windows\System\hEKcYhl.exe
  C:\Windows\System\hEKcYhl.exe
  2⤵
  PID:12896
- C:\Windows\System\zxJSTaZ.exe
  C:\Windows\System\zxJSTaZ.exe
  2⤵
  PID:12916
- C:\Windows\System\JVHONov.exe
  C:\Windows\System\JVHONov.exe
  2⤵
  PID:12940
- C:\Windows\System\ufAjdFo.exe
  C:\Windows\System\ufAjdFo.exe
  2⤵
  PID:12960
- C:\Windows\System\tkLnEVL.exe
  C:\Windows\System\tkLnEVL.exe
  2⤵
  PID:12988
- C:\Windows\System\dXBkQtR.exe
  C:\Windows\System\dXBkQtR.exe
  2⤵
  PID:13036
- C:\Windows\System\wBObOZF.exe
  C:\Windows\System\wBObOZF.exe
  2⤵
  PID:13056
- C:\Windows\System\EAXJdkF.exe
  C:\Windows\System\EAXJdkF.exe
  2⤵
  PID:13084
- C:\Windows\System\FYsYjFv.exe
  C:\Windows\System\FYsYjFv.exe
  2⤵
  PID:13112
- C:\Windows\System\GeRWLDR.exe
  C:\Windows\System\GeRWLDR.exe
  2⤵
  PID:13152
- C:\Windows\System\ellWGGN.exe
  C:\Windows\System\ellWGGN.exe
  2⤵
  PID:13168
- C:\Windows\System\qrFJMJQ.exe
  C:\Windows\System\qrFJMJQ.exe
  2⤵
  PID:13200
- C:\Windows\System\lGGrVJG.exe
  C:\Windows\System\lGGrVJG.exe
  2⤵
  PID:13220
- C:\Windows\System\KtbyVur.exe
  C:\Windows\System\KtbyVur.exe
  2⤵
  PID:13248
- C:\Windows\System\sjmlygP.exe
  C:\Windows\System\sjmlygP.exe
  2⤵
  PID:13296
- C:\Windows\System\mHHAxsD.exe
  C:\Windows\System\mHHAxsD.exe
  2⤵
  PID:11756
- C:\Windows\System\IDvLYyL.exe
  C:\Windows\System\IDvLYyL.exe
  2⤵
  PID:12336
- C:\Windows\System\ydgJhAH.exe
  C:\Windows\System\ydgJhAH.exe
  2⤵
  PID:12368
- C:\Windows\System\npWyDDr.exe
  C:\Windows\System\npWyDDr.exe
  2⤵
  PID:12468
- C:\Windows\System\GzDiEYa.exe
  C:\Windows\System\GzDiEYa.exe
  2⤵
  PID:12496
- C:\Windows\System\eDTNJin.exe
  C:\Windows\System\eDTNJin.exe
  2⤵
  PID:12600
- C:\Windows\System\aoIMicV.exe
  C:\Windows\System\aoIMicV.exe
  2⤵
  PID:12660
- C:\Windows\System\UeHLSjl.exe
  C:\Windows\System\UeHLSjl.exe
  2⤵
  PID:12692
- C:\Windows\System\qAoxsDM.exe
  C:\Windows\System\qAoxsDM.exe
  2⤵
  PID:12752
- C:\Windows\System\vrvSXvI.exe
  C:\Windows\System\vrvSXvI.exe
  2⤵
  PID:12792
- C:\Windows\System\DYcAbgd.exe
  C:\Windows\System\DYcAbgd.exe
  2⤵
  PID:12892
- C:\Windows\System\haJmmeK.exe
  C:\Windows\System\haJmmeK.exe
  2⤵
  PID:12980
- C:\Windows\System\xQoTqVX.exe
  C:\Windows\System\xQoTqVX.exe
  2⤵
  PID:13048
- C:\Windows\System\ryiVerb.exe
  C:\Windows\System\ryiVerb.exe
  2⤵
  PID:13104
- C:\Windows\System\RWCoXKd.exe
  C:\Windows\System\RWCoXKd.exe
  2⤵
  PID:13208
- C:\Windows\System\EAocgVX.exe
  C:\Windows\System\EAocgVX.exe
  2⤵
  PID:13236
- C:\Windows\System\YqQFUey.exe
  C:\Windows\System\YqQFUey.exe
  2⤵
  PID:11348
- C:\Windows\System\kXUcKbF.exe
  C:\Windows\System\kXUcKbF.exe
  2⤵
  PID:12360
- C:\Windows\System\fWEjEPN.exe
  C:\Windows\System\fWEjEPN.exe
  2⤵
  PID:12492
- C:\Windows\System\JCMOxpX.exe
  C:\Windows\System\JCMOxpX.exe
  2⤵
  PID:12732
- C:\Windows\System\zNcZNfq.exe
  C:\Windows\System\zNcZNfq.exe
  2⤵
  PID:12868
- C:\Windows\System\IMqNaFN.exe
  C:\Windows\System\IMqNaFN.exe
  2⤵
  PID:13008
- C:\Windows\System\ymfFgLh.exe
  C:\Windows\System\ymfFgLh.exe
  2⤵
  PID:13076
- C:\Windows\System\VdavFfv.exe
  C:\Windows\System\VdavFfv.exe
  2⤵
  PID:12220
- C:\Windows\System\sLXQCDn.exe
  C:\Windows\System\sLXQCDn.exe
  2⤵
  PID:12648
- C:\Windows\System\etDgaxb.exe
  C:\Windows\System\etDgaxb.exe
  2⤵
  PID:12848
- C:\Windows\System\ookeNRt.exe
  C:\Windows\System\ookeNRt.exe
  2⤵
  PID:13228
- C:\Windows\System\yVVVxOU.exe
  C:\Windows\System\yVVVxOU.exe
  2⤵
  PID:13320
- C:\Windows\System\tXMoWPK.exe
  C:\Windows\System\tXMoWPK.exe
  2⤵
  PID:13352
- C:\Windows\System\splgsdm.exe
  C:\Windows\System\splgsdm.exe
  2⤵
  PID:13380
- C:\Windows\System\KAQELvM.exe
  C:\Windows\System\KAQELvM.exe
  2⤵
  PID:13412
- C:\Windows\System\HBRBlaa.exe
  C:\Windows\System\HBRBlaa.exe
  2⤵
  PID:13448
- C:\Windows\System\AGnvKTJ.exe
  C:\Windows\System\AGnvKTJ.exe
  2⤵
  PID:13468
- C:\Windows\System\gFKClsA.exe
  C:\Windows\System\gFKClsA.exe
  2⤵
  PID:13484
- C:\Windows\System\mJiXfQD.exe
  C:\Windows\System\mJiXfQD.exe
  2⤵
  PID:13500
- C:\Windows\System\DWHvswm.exe
  C:\Windows\System\DWHvswm.exe
  2⤵
  PID:13532
- C:\Windows\System\OnZfwFF.exe
  C:\Windows\System\OnZfwFF.exe
  2⤵
  PID:13560
- C:\Windows\System\sIgevnf.exe
  C:\Windows\System\sIgevnf.exe
  2⤵
  PID:13580
- C:\Windows\System\IhAOIUE.exe
  C:\Windows\System\IhAOIUE.exe
  2⤵
  PID:13596
- C:\Windows\System\wZbIfIu.exe
  C:\Windows\System\wZbIfIu.exe
  2⤵
  PID:13636
- C:\Windows\System\qTHTVNN.exe
  C:\Windows\System\qTHTVNN.exe
  2⤵
  PID:13692
- C:\Windows\System\iTdxSXr.exe
  C:\Windows\System\iTdxSXr.exe
  2⤵
  PID:13732
- C:\Windows\System\nUTAdac.exe
  C:\Windows\System\nUTAdac.exe
  2⤵
  PID:13748
- C:\Windows\System\aAeDPlx.exe
  C:\Windows\System\aAeDPlx.exe
  2⤵
  PID:13776
- C:\Windows\System\AAEFJZC.exe
  C:\Windows\System\AAEFJZC.exe
  2⤵
  PID:13812
- C:\Windows\System\dCndguN.exe
  C:\Windows\System\dCndguN.exe
  2⤵
  PID:13832
- C:\Windows\System\hJfmyzq.exe
  C:\Windows\System\hJfmyzq.exe
  2⤵
  PID:13848
- C:\Windows\System\KtJQyKv.exe
  C:\Windows\System\KtJQyKv.exe
  2⤵
  PID:13864
- C:\Windows\System\rBavfsw.exe
  C:\Windows\System\rBavfsw.exe
  2⤵
  PID:13900
- C:\Windows\System\RPhQkDp.exe
  C:\Windows\System\RPhQkDp.exe
  2⤵
  PID:13952
- C:\Windows\System\TloazFS.exe
  C:\Windows\System\TloazFS.exe
  2⤵
  PID:13972
- C:\Windows\System\agyztwr.exe
  C:\Windows\System\agyztwr.exe
  2⤵
  PID:13988
- C:\Windows\System\wksnycT.exe
  C:\Windows\System\wksnycT.exe
  2⤵
  PID:14032
- C:\Windows\System\dELHMSJ.exe
  C:\Windows\System\dELHMSJ.exe
  2⤵
  PID:14048
- C:\Windows\System\PJOYLMw.exe
  C:\Windows\System\PJOYLMw.exe
  2⤵
  PID:14092
- C:\Windows\System\svHwCME.exe
  C:\Windows\System\svHwCME.exe
  2⤵
  PID:14136
- C:\Windows\System\AxKCIxC.exe
  C:\Windows\System\AxKCIxC.exe
  2⤵
  PID:14152
- C:\Windows\System\IXTRDrf.exe
  C:\Windows\System\IXTRDrf.exe
  2⤵
  PID:14168
- C:\Windows\System\seexRYn.exe
  C:\Windows\System\seexRYn.exe
  2⤵
  PID:14200
- C:\Windows\System\pbMAZNY.exe
  C:\Windows\System\pbMAZNY.exe
  2⤵
  PID:14220
- C:\Windows\System\wNvBjtc.exe
  C:\Windows\System\wNvBjtc.exe
  2⤵
  PID:14240
- C:\Windows\System\wDJHOan.exe
  C:\Windows\System\wDJHOan.exe
  2⤵
  PID:14268
- C:\Windows\System\hlQdWPf.exe
  C:\Windows\System\hlQdWPf.exe
  2⤵
  PID:14300
- C:\Windows\System\HutjBIl.exe
  C:\Windows\System\HutjBIl.exe
  2⤵
  PID:14320
- C:\Windows\System\OxYYlit.exe
  C:\Windows\System\OxYYlit.exe
  2⤵
  PID:12616
- C:\Windows\System\JXiwkCI.exe
  C:\Windows\System\JXiwkCI.exe
  2⤵
  PID:12352
- C:\Windows\System\ttSwWnF.exe
  C:\Windows\System\ttSwWnF.exe
  2⤵
  PID:13396
- C:\Windows\System\WyTNvhA.exe
  C:\Windows\System\WyTNvhA.exe
  2⤵
  PID:13372
- C:\Windows\System\MfYTQRN.exe
  C:\Windows\System\MfYTQRN.exe
  2⤵
  PID:13496
- C:\Windows\System\fDZkIvZ.exe
  C:\Windows\System\fDZkIvZ.exe
  2⤵
  PID:13548
- C:\Windows\System\vRdarjh.exe
  C:\Windows\System\vRdarjh.exe
  2⤵
  PID:13620
- C:\Windows\System\OsdDCql.exe
  C:\Windows\System\OsdDCql.exe
  2⤵
  PID:13700
- C:\Windows\System\mmThdIZ.exe
  C:\Windows\System\mmThdIZ.exe
  2⤵
  PID:13860
- C:\Windows\System\VaDKuqE.exe
  C:\Windows\System\VaDKuqE.exe
  2⤵
  PID:13888
- C:\Windows\System\jzXCmKb.exe
  C:\Windows\System\jzXCmKb.exe
  2⤵
  PID:14016
- C:\Windows\System\DjAqmQv.exe
  C:\Windows\System\DjAqmQv.exe
  2⤵
  PID:14040
- C:\Windows\System\pRvedBS.exe
  C:\Windows\System\pRvedBS.exe
  2⤵
  PID:14088
- C:\Windows\System\bxPCNHg.exe
  C:\Windows\System\bxPCNHg.exe
  2⤵
  PID:14132
- C:\Windows\System\CchtFly.exe
  C:\Windows\System\CchtFly.exe
  2⤵
  PID:14184
- C:\Windows\System\lfOpFFG.exe
  C:\Windows\System\lfOpFFG.exe
  2⤵
  PID:14292
- C:\Windows\System\FSKJztM.exe
  C:\Windows\System\FSKJztM.exe
  2⤵
  PID:13340
- C:\Windows\System\kOLiXOn.exe
  C:\Windows\System\kOLiXOn.exe
  2⤵
  PID:13188
- C:\Windows\System\nZHkQJC.exe
  C:\Windows\System\nZHkQJC.exe
  2⤵
  PID:13568
- C:\Windows\System\crpgclv.exe
  C:\Windows\System\crpgclv.exe
  2⤵
  PID:13724
- C:\Windows\System\otclWqe.exe
  C:\Windows\System\otclWqe.exe
  2⤵
  PID:14008
- C:\Windows\System\wdTZnLG.exe
  C:\Windows\System\wdTZnLG.exe
  2⤵
  PID:14120
- C:\Windows\System\BkifhTB.exe
  C:\Windows\System\BkifhTB.exe
  2⤵
  PID:14252
- C:\Windows\System\ygYArsx.exe
  C:\Windows\System\ygYArsx.exe
  2⤵
  PID:14308
- C:\Windows\System\emAuIyo.exe
  C:\Windows\System\emAuIyo.exe
  2⤵
  PID:13624
- C:\Windows\System\uCoCNPL.exe
  C:\Windows\System\uCoCNPL.exe
  2⤵
  PID:13884
- C:\Windows\System\DEGACNt.exe
  C:\Windows\System\DEGACNt.exe
  2⤵
  PID:14084
- C:\Windows\System\lXYBBSA.exe
  C:\Windows\System\lXYBBSA.exe
  2⤵
  PID:14296
- C:\Windows\System\AJjcHFQ.exe
  C:\Windows\System\AJjcHFQ.exe
  2⤵
  PID:14380
- C:\Windows\System\egcFUmF.exe
  C:\Windows\System\egcFUmF.exe
  2⤵
  PID:14412
- C:\Windows\System\TBTAffM.exe
  C:\Windows\System\TBTAffM.exe
  2⤵
  PID:14432
- C:\Windows\System\sjDMlys.exe
  C:\Windows\System\sjDMlys.exe
  2⤵
  PID:14448
- C:\Windows\System\wstxDph.exe
  C:\Windows\System\wstxDph.exe
  2⤵
  PID:14488
- C:\Windows\System\NhuVxZi.exe
  C:\Windows\System\NhuVxZi.exe
  2⤵
  PID:14520
- C:\Windows\System\QdDwYKm.exe
  C:\Windows\System\QdDwYKm.exe
  2⤵
  PID:14552
- C:\Windows\System\wNLqHWX.exe
  C:\Windows\System\wNLqHWX.exe
  2⤵
  PID:14568
- C:\Windows\System\LSeKwmY.exe
  C:\Windows\System\LSeKwmY.exe
  2⤵
  PID:14620
- C:\Windows\System\WBKcpCI.exe
  C:\Windows\System\WBKcpCI.exe
  2⤵
  PID:14636
- C:\Windows\System\tClHege.exe
  C:\Windows\System\tClHege.exe
  2⤵
  PID:14656
- C:\Windows\System\ikfHtAh.exe
  C:\Windows\System\ikfHtAh.exe
  2⤵
  PID:14716
- C:\Windows\System\IygAJJN.exe
  C:\Windows\System\IygAJJN.exe
  2⤵
  PID:14732
- C:\Windows\System\TALWLoa.exe
  C:\Windows\System\TALWLoa.exe
  2⤵
  PID:14760
- C:\Windows\System\bogZtOt.exe
  C:\Windows\System\bogZtOt.exe
  2⤵
  PID:14788
- C:\Windows\System\IZRVgAH.exe
  C:\Windows\System\IZRVgAH.exe
  2⤵
  PID:14816
- C:\Windows\System\dypfiiU.exe
  C:\Windows\System\dypfiiU.exe
  2⤵
  PID:14840
- C:\Windows\System\wETcQOO.exe
  C:\Windows\System\wETcQOO.exe
  2⤵
  PID:14860
- C:\Windows\System\VsFXvJa.exe
  C:\Windows\System\VsFXvJa.exe
  2⤵
  PID:14912
- C:\Windows\System\OjanmHP.exe
  C:\Windows\System\OjanmHP.exe
  2⤵
  PID:14928
- C:\Windows\System\oEgpAIw.exe
  C:\Windows\System\oEgpAIw.exe
  2⤵
  PID:14952
- C:\Windows\System\IbQBaYx.exe
  C:\Windows\System\IbQBaYx.exe
  2⤵
  PID:14972
- C:\Windows\System\CCSEvas.exe
  C:\Windows\System\CCSEvas.exe
  2⤵
  PID:14988
- C:\Windows\System\vruGaGi.exe
  C:\Windows\System\vruGaGi.exe
  2⤵
  PID:15012
- C:\Windows\System\gfkhTyH.exe
  C:\Windows\System\gfkhTyH.exe
  2⤵
  PID:15036
- C:\Windows\System\eutanak.exe
  C:\Windows\System\eutanak.exe
  2⤵
  PID:15072
- C:\Windows\System\OyJlFxF.exe
  C:\Windows\System\OyJlFxF.exe
  2⤵
  PID:15112
- C:\Windows\System\OkqEeyd.exe
  C:\Windows\System\OkqEeyd.exe
  2⤵
  PID:15144
- C:\Windows\System\IjxwCLD.exe
  C:\Windows\System\IjxwCLD.exe
  2⤵
  PID:15168
- C:\Windows\System\GWbXyov.exe
  C:\Windows\System\GWbXyov.exe
  2⤵
  PID:15184
- C:\Windows\System\IPeXEOp.exe
  C:\Windows\System\IPeXEOp.exe
  2⤵
  PID:15204
- C:\Windows\System\gRwjJSS.exe
  C:\Windows\System\gRwjJSS.exe
  2⤵
  PID:15232
- C:\Windows\System\FwskLps.exe
  C:\Windows\System\FwskLps.exe
  2⤵
  PID:15256
- C:\Windows\System\qVcSvaO.exe
  C:\Windows\System\qVcSvaO.exe
  2⤵
  PID:15292
- C:\Windows\System\QUmJqOz.exe
  C:\Windows\System\QUmJqOz.exe
  2⤵
  PID:15316
- C:\Windows\System\fnnXVbL.exe
  C:\Windows\System\fnnXVbL.exe
  2⤵
  PID:15340
- C:\Windows\System\SXpwPtD.exe
  C:\Windows\System\SXpwPtD.exe
  2⤵
  PID:14340
- C:\Windows\System\lDXddQv.exe
  C:\Windows\System\lDXddQv.exe
  2⤵
  PID:14368
- C:\Windows\System\iHHCbOU.exe
  C:\Windows\System\iHHCbOU.exe
  2⤵
  PID:14440
- C:\Windows\System\xnadlKr.exe
  C:\Windows\System\xnadlKr.exe
  2⤵
  PID:14500
- C:\Windows\System\IUNfILU.exe
  C:\Windows\System\IUNfILU.exe
  2⤵
  PID:14564
- C:\Windows\System\qMdKozN.exe
  C:\Windows\System\qMdKozN.exe
  2⤵
  PID:14648
- C:\Windows\System\tpwpiTM.exe
  C:\Windows\System\tpwpiTM.exe
  2⤵
  PID:14728
- C:\Windows\System\JkDGiYG.exe
  C:\Windows\System\JkDGiYG.exe
  2⤵
  PID:14780
- C:\Windows\System\nLbypXI.exe
  C:\Windows\System\nLbypXI.exe
  2⤵
  PID:14852
- C:\Windows\System\MhnsaGq.exe
  C:\Windows\System\MhnsaGq.exe
  2⤵
  PID:14944
- C:\Windows\System\InByAEa.exe
  C:\Windows\System\InByAEa.exe
  2⤵
  PID:14980
- C:\Windows\System\BfbPUUO.exe
  C:\Windows\System\BfbPUUO.exe
  2⤵
  PID:15048
- C:\Windows\System\fcyHgdj.exe
  C:\Windows\System\fcyHgdj.exe
  2⤵
  PID:15096
- C:\Windows\System\dRGDpPu.exe
  C:\Windows\System\dRGDpPu.exe
  2⤵
  PID:15160
- C:\Windows\System\cRBaVaa.exe
  C:\Windows\System\cRBaVaa.exe
  2⤵
  PID:15180
- C:\Windows\System\kNfByCW.exe
  C:\Windows\System\kNfByCW.exe
  2⤵
  PID:15244
- C:\Windows\System\iMBuRma.exe
  C:\Windows\System\iMBuRma.exe
  2⤵
  PID:15304
- C:\Windows\System\rpvxOrs.exe
  C:\Windows\System\rpvxOrs.exe
  2⤵
  PID:15352
- C:\Windows\System\QBVAMql.exe
  C:\Windows\System\QBVAMql.exe
  2⤵
  PID:14428
- C:\Windows\System\joMfwhd.exe
  C:\Windows\System\joMfwhd.exe
  2⤵
  PID:14540
- C:\Windows\System\nmUZzEK.exe
  C:\Windows\System\nmUZzEK.exe
  2⤵
  PID:14784
- C:\Windows\System\HsbrIBg.exe
  C:\Windows\System\HsbrIBg.exe
  2⤵
  PID:14832
- C:\Windows\System\chBmfEo.exe
  C:\Windows\System\chBmfEo.exe
  2⤵
  PID:15060
- C:\Windows\System\pilTxgh.exe
  C:\Windows\System\pilTxgh.exe
  2⤵
  PID:14312
- C:\Windows\System\waaJUzM.exe
  C:\Windows\System\waaJUzM.exe
  2⤵
  PID:14476
- C:\Windows\System\vPXJCWn.exe
  C:\Windows\System\vPXJCWn.exe
  2⤵
  PID:14872
- C:\Windows\System\UasRbMj.exe
  C:\Windows\System\UasRbMj.exe
  2⤵
  PID:15084
- C:\Windows\System\QAJqaAk.exe
  C:\Windows\System\QAJqaAk.exe
  2⤵
  PID:15364
- C:\Windows\System\yqiqljj.exe
  C:\Windows\System\yqiqljj.exe
  2⤵
  PID:15380
- C:\Windows\System\nhWVtDA.exe
  C:\Windows\System\nhWVtDA.exe
  2⤵
  PID:15404
- C:\Windows\System\dqIImJr.exe
  C:\Windows\System\dqIImJr.exe
  2⤵
  PID:15420
- C:\Windows\System\QfhhRhT.exe
  C:\Windows\System\QfhhRhT.exe
  2⤵
  PID:15436
- C:\Windows\System\cKPjGNM.exe
  C:\Windows\System\cKPjGNM.exe
  2⤵
  PID:15452
- C:\Windows\System\ypzUcor.exe
  C:\Windows\System\ypzUcor.exe
  2⤵
  PID:15476
- C:\Windows\System\hOETRtC.exe
  C:\Windows\System\hOETRtC.exe
  2⤵
  PID:15492
- C:\Windows\System\pXMCURu.exe
  C:\Windows\System\pXMCURu.exe
  2⤵
  PID:15508
- C:\Windows\System\iFyTgvY.exe
  C:\Windows\System\iFyTgvY.exe
  2⤵
  PID:15524
- C:\Windows\System\qzgNGMe.exe
  C:\Windows\System\qzgNGMe.exe
  2⤵
  PID:15540
- C:\Windows\System\PeIwaoC.exe
  C:\Windows\System\PeIwaoC.exe
  2⤵
  PID:15572
- C:\Windows\System\HolhDJd.exe
  C:\Windows\System\HolhDJd.exe
  2⤵
  PID:15604
- C:\Windows\System\CZzdois.exe
  C:\Windows\System\CZzdois.exe
  2⤵
  PID:15620
- C:\Windows\System\wligXYA.exe
  C:\Windows\System\wligXYA.exe
  2⤵
  PID:15640
- C:\Windows\System\etXFuVj.exe
  C:\Windows\System\etXFuVj.exe
  2⤵
  PID:15660
- C:\Windows\System\idhQTxd.exe
  C:\Windows\System\idhQTxd.exe
  2⤵
  PID:15676
- C:\Windows\System\MeOkXov.exe
  C:\Windows\System\MeOkXov.exe
  2⤵
  PID:15692
- C:\Windows\System\VbRSsNV.exe
  C:\Windows\System\VbRSsNV.exe
  2⤵
  PID:15708
- C:\Windows\System\IDDVGVW.exe
  C:\Windows\System\IDDVGVW.exe
  2⤵
  PID:15732
- C:\Windows\System\obTsrfo.exe
  C:\Windows\System\obTsrfo.exe
  2⤵
  PID:15752
- C:\Windows\System\ZzYESek.exe
  C:\Windows\System\ZzYESek.exe
  2⤵
  PID:15780
- C:\Windows\System\cBonaOv.exe
  C:\Windows\System\cBonaOv.exe
  2⤵
  PID:15808
- C:\Windows\System\GOYhzMU.exe
  C:\Windows\System\GOYhzMU.exe
  2⤵
  PID:15828
- C:\Windows\System\FiPZCys.exe
  C:\Windows\System\FiPZCys.exe
  2⤵
  PID:15848
- C:\Windows\System\FXfGkgk.exe
  C:\Windows\System\FXfGkgk.exe
  2⤵
  PID:15868
- C:\Windows\System\eGHgDWd.exe
  C:\Windows\System\eGHgDWd.exe
  2⤵
  PID:15900
- C:\Windows\System\BoNmFLl.exe
  C:\Windows\System\BoNmFLl.exe
  2⤵
  PID:15916
- C:\Windows\System\yiZzehz.exe
  C:\Windows\System\yiZzehz.exe
  2⤵
  PID:15932
- C:\Windows\System\oDqndnT.exe
  C:\Windows\System\oDqndnT.exe
  2⤵
  PID:15948
- C:\Windows\System\hBQuCOS.exe
  C:\Windows\System\hBQuCOS.exe
  2⤵
  PID:15976
- C:\Windows\System\OeVnXXK.exe
  C:\Windows\System\OeVnXXK.exe
  2⤵
  PID:16000
- C:\Windows\System\TSdygQT.exe
  C:\Windows\System\TSdygQT.exe
  2⤵
  PID:16024
- C:\Windows\System\cxcFiMO.exe
  C:\Windows\System\cxcFiMO.exe
  2⤵
  PID:16044
- C:\Windows\System\lAafPHS.exe
  C:\Windows\System\lAafPHS.exe
  2⤵
  PID:16060
- C:\Windows\System\AXJObiV.exe
  C:\Windows\System\AXJObiV.exe
  2⤵
  PID:16076
- C:\Windows\System\GKReJuH.exe
  C:\Windows\System\GKReJuH.exe
  2⤵
  PID:16108
- C:\Windows\System\mZYiPeo.exe
  C:\Windows\System\mZYiPeo.exe
  2⤵
  PID:16128
- C:\Windows\System\yrwaRLx.exe
  C:\Windows\System\yrwaRLx.exe
  2⤵
  PID:16148
- C:\Windows\System\ZnrDQwp.exe
  C:\Windows\System\ZnrDQwp.exe
  2⤵
  PID:16172
- C:\Windows\System\ALdxdAe.exe
  C:\Windows\System\ALdxdAe.exe
  2⤵
  PID:16192
- C:\Windows\System\GiRpIAc.exe
  C:\Windows\System\GiRpIAc.exe
  2⤵
  PID:16220
- C:\Windows\System\rvYynPG.exe
  C:\Windows\System\rvYynPG.exe
  2⤵
  PID:16236
- C:\Windows\System\zFHsbFi.exe
  C:\Windows\System\zFHsbFi.exe
  2⤵
  PID:16256
- C:\Windows\System\LpnsCyl.exe
  C:\Windows\System\LpnsCyl.exe
  2⤵
  PID:16272
- C:\Windows\System\bkssnrH.exe
  C:\Windows\System\bkssnrH.exe
  2⤵
  PID:16292
- C:\Windows\System\ePcaJxU.exe
  C:\Windows\System\ePcaJxU.exe
  2⤵
  PID:16308
- C:\Windows\System\cBSpbxL.exe
  C:\Windows\System\cBSpbxL.exe
  2⤵
  PID:16332
- C:\Windows\System\TnDJkKN.exe
  C:\Windows\System\TnDJkKN.exe
  2⤵
  PID:16356
- C:\Windows\System\QYArMQd.exe
  C:\Windows\System\QYArMQd.exe
  2⤵
  PID:16372
- C:\Windows\System\NztVZWe.exe
  C:\Windows\System\NztVZWe.exe
  2⤵
  PID:14704
- C:\Windows\System\eynwfFm.exe
  C:\Windows\System\eynwfFm.exe
  2⤵
  PID:15444
- C:\Windows\System\tUjffFD.exe
  C:\Windows\System\tUjffFD.exe
  2⤵
  PID:15392
- C:\Windows\System\rrxTpkO.exe
  C:\Windows\System\rrxTpkO.exe
  2⤵
  PID:15428
- C:\Windows\System\fQgRzuI.exe
  C:\Windows\System\fQgRzuI.exe
  2⤵
  PID:15484
- C:\Windows\System\sgCbAvp.exe
  C:\Windows\System\sgCbAvp.exe
  2⤵
  PID:15672
- C:\Windows\System\LkwyzrH.exe
  C:\Windows\System\LkwyzrH.exe
  2⤵
  PID:15688
- C:\Windows\System\gxuXQio.exe
  C:\Windows\System\gxuXQio.exe
  2⤵
  PID:15552
- C:\Windows\System\PgigqPv.exe
  C:\Windows\System\PgigqPv.exe
  2⤵
  PID:15836
- C:\Windows\System\CGaygzC.exe
  C:\Windows\System\CGaygzC.exe
  2⤵
  PID:15892
- C:\Windows\System\zwVJTkR.exe
  C:\Windows\System\zwVJTkR.exe
  2⤵
  PID:15724
- C:\Windows\System\HMKsTGI.exe
  C:\Windows\System\HMKsTGI.exe
  2⤵
  PID:15616
- C:\Windows\System\UXfQZTF.exe
  C:\Windows\System\UXfQZTF.exe
  2⤵
  PID:16068
- C:\Windows\System\nKhEDru.exe
  C:\Windows\System\nKhEDru.exe
  2⤵
  PID:16136
- C:\Windows\System\wZzYeDT.exe
  C:\Windows\System\wZzYeDT.exe
  2⤵
  PID:16232
- C:\Windows\System\eUPWScb.exe
  C:\Windows\System\eUPWScb.exe
  2⤵
  PID:15968
- C:\Windows\System\WnfACPR.exe
  C:\Windows\System\WnfACPR.exe
  2⤵
  PID:16288
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16288 -s 248
    3⤵
    PID:15960
- C:\Windows\System\Onxhnol.exe
  C:\Windows\System\Onxhnol.exe
  2⤵
  PID:15824
- C:\Windows\System\ecuKdPU.exe
  C:\Windows\System\ecuKdPU.exe
  2⤵
  PID:16320
- C:\Windows\System\kYGjPbj.exe
  C:\Windows\System\kYGjPbj.exe
  2⤵
  PID:16396
- C:\Windows\System\fxKUlUz.exe
  C:\Windows\System\fxKUlUz.exe
  2⤵
  PID:16412
- C:\Windows\System\LAYOufD.exe
  C:\Windows\System\LAYOufD.exe
  2⤵
  PID:16448
- C:\Windows\System\XSmWrWI.exe
  C:\Windows\System\XSmWrWI.exe
  2⤵
  PID:16464
- C:\Windows\System\cHNLREl.exe
  C:\Windows\System\cHNLREl.exe
  2⤵
  PID:16488
- C:\Windows\System\MTlJcpJ.exe
  C:\Windows\System\MTlJcpJ.exe
  2⤵
  PID:16504
- C:\Windows\System\hiYGFfe.exe
  C:\Windows\System\hiYGFfe.exe
  2⤵
  PID:16520
- C:\Windows\System\mCTOehK.exe
  C:\Windows\System\mCTOehK.exe
  2⤵
  PID:16540
- C:\Windows\System\sTToxOq.exe
  C:\Windows\System\sTToxOq.exe
  2⤵
  PID:16560
- C:\Windows\System\cxOypJx.exe
  C:\Windows\System\cxOypJx.exe
  2⤵
  PID:16580
- C:\Windows\System\bsNPXAm.exe
  C:\Windows\System\bsNPXAm.exe
  2⤵
  PID:16596
- C:\Windows\System\ABuQgYd.exe
  C:\Windows\System\ABuQgYd.exe
  2⤵
  PID:16612
- C:\Windows\System\eDlTtJA.exe
  C:\Windows\System\eDlTtJA.exe
  2⤵
  PID:16644
- C:\Windows\System\QgwGYsB.exe
  C:\Windows\System\QgwGYsB.exe
  2⤵
  PID:16660
- C:\Windows\System\QuTLICZ.exe
  C:\Windows\System\QuTLICZ.exe
  2⤵
  PID:16688
- C:\Windows\System\xNekwGl.exe
  C:\Windows\System\xNekwGl.exe
  2⤵
  PID:16704
- C:\Windows\System\SxoXLBW.exe
  C:\Windows\System\SxoXLBW.exe
  2⤵
  PID:16724
- C:\Windows\System\AoylhVZ.exe
  C:\Windows\System\AoylhVZ.exe
  2⤵
  PID:16748
- C:\Windows\System\dvgBzlY.exe
  C:\Windows\System\dvgBzlY.exe
  2⤵
  PID:16788
- C:\Windows\System\mgaYsbR.exe
  C:\Windows\System\mgaYsbR.exe
  2⤵
  PID:16808
- C:\Windows\System\RdpJFeW.exe
  C:\Windows\System\RdpJFeW.exe
  2⤵
  PID:16840
- C:\Windows\System\rzcYuhO.exe
  C:\Windows\System\rzcYuhO.exe
  2⤵
  PID:16864
- C:\Windows\System\MHQshti.exe
  C:\Windows\System\MHQshti.exe
  2⤵
  PID:16268
- C:\Windows\System\DHDUySV.exe
  C:\Windows\System\DHDUySV.exe
  2⤵
  PID:16348
- C:\Windows\System\uRPuXKx.exe
  C:\Windows\System\uRPuXKx.exe
  2⤵
  PID:16516
- C:\Windows\System\LJnSdMJ.exe
  C:\Windows\System\LJnSdMJ.exe
  2⤵
  PID:16180
- C:\Windows\System\AppfNmu.exe
  C:\Windows\System\AppfNmu.exe
  2⤵
  PID:16592
- C:\Windows\System\AQuIooN.exe
  C:\Windows\System\AQuIooN.exe
  2⤵
  PID:16672
- C:\Windows\System\ScHyMIG.exe
  C:\Windows\System\ScHyMIG.exe
  2⤵
  PID:16740
- C:\Windows\System\HrUbHVu.exe
  C:\Windows\System\HrUbHVu.exe
  2⤵
  PID:16832
- C:\Windows\System\OZIwmGi.exe
  C:\Windows\System\OZIwmGi.exe
  2⤵
  PID:16880
- C:\Windows\System\SyBSxXt.exe
  C:\Windows\System\SyBSxXt.exe
  2⤵
  PID:16388
- C:\Windows\System\aVlBRES.exe
  C:\Windows\System\aVlBRES.exe
  2⤵
  PID:16636
- C:\Windows\System\uOroGGH.exe
  C:\Windows\System\uOroGGH.exe
  2⤵
  PID:16760
- C:\Windows\System\HxEZORz.exe
  C:\Windows\System\HxEZORz.exe
  2⤵
  PID:15896
- C:\Windows\System\OVAVFOq.exe
  C:\Windows\System\OVAVFOq.exe
  2⤵
  PID:16652
- C:\Windows\System\IFXhDFt.exe
  C:\Windows\System\IFXhDFt.exe
  2⤵
  PID:16604
- C:\Windows\System\wXWGWxw.exe
  C:\Windows\System\wXWGWxw.exe
  2⤵
  PID:17252
- C:\Windows\System\ctViKXQ.exe
  C:\Windows\System\ctViKXQ.exe
  2⤵
  PID:16676
- C:\Windows\System\bhznFus.exe
  C:\Windows\System\bhznFus.exe
  2⤵
  PID:2676
- C:\Windows\System\ztiCkUZ.exe
  C:\Windows\System\ztiCkUZ.exe
  2⤵
  PID:1068
- C:\Windows\System\YEIiNKg.exe
  C:\Windows\System\YEIiNKg.exe
  2⤵
  PID:16696
- C:\Windows\System\PJSRPes.exe
  C:\Windows\System\PJSRPes.exe
  2⤵
  PID:16436
- C:\Windows\System\rsmVcPs.exe
  C:\Windows\System\rsmVcPs.exe
  2⤵
  PID:16532

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\FyiAxUG.exe

Filesize
1.2MB

MD5
2c260aa570dc80c63eed34fb84c783b1

SHA1
a561515a02093afb066604640a2ee7f30877cddc

SHA256
c35f5d77e07a66946e5da19c44b7e4d3aafd0bdaab37af21ca84270342f632d7

SHA512
ff51ea4548150bd4e1935cfc30573f24791fa58269840db5f9e365e8616a1c017743e4594be9c80c92e7c9c9f6642b8d1f27b1f37f6d61bf2cfe97534b0437c9

Download Submit
C:\Windows\System\GFvjvHZ.exe

Filesize
1.2MB

MD5
4c3ea86d20575dffc4eca550cb087c30

SHA1
775fb8e8a085e79b45d21977d39f48313d0620de

SHA256
b96d9161a62a8015dc58ee9f38cb69be9be9ddafa5e5bb56ccc1a7dbcec3b66d

SHA512
2d5730d54527f07a730428a653999a6130f832556273d19561aa02f0ba01a7ad7365815553192bd2b4e73ea8b056d806c7a008961ad137fb637401d0da75cf69

Download Submit
C:\Windows\System\GIsJLfi.exe

Filesize
1.2MB

MD5
9cdfc92a8b6aaeb2186777f810b5cb15

SHA1
5cca0be19ab4cc121e11f492e7a3c40479b826d3

SHA256
5328bb015035155425a7abe2a5977208af628b9831f7343e4c7a9236a89e6572

SHA512
c56ead2183cf076cecfc58692e4b8c536fa99eaee2a659084626345c0450cf52306a46051fc63e901acdca925460e9142055cdf0b768b3b18f870f2d071dfbb3

Download Submit
C:\Windows\System\GUMYjWE.exe

Filesize
1.2MB

MD5
8e8002669f45180f90c0b6c5f2ee308b

SHA1
db6948fb455a5ed6ea28449b891824b0f32d6e9c

SHA256
444944e1244193ef91253e893a50c914c7c21b58b11a606b93258f999c1b97ed

SHA512
bcab233760ec8e4028ee05087fe8b9012378402636ae435613d1e0e79acb12c1714c3fbe6cbaa3376fa99f376f381daf9bb1aa825a8decbaae314eed97e6458d

Download Submit
C:\Windows\System\LgaIcYg.exe

Filesize
1.2MB

MD5
4199f9888db5d491b41396170dfba0ba

SHA1
c8ba17a5a0fed0574d0bd64c124c7ffff50220c9

SHA256
d98e452cf417c357e9fd834dcf3680b18db6cf9263a29c16ef19705a7f34948a

SHA512
7a54451ba13fc86902d014a66d2bc78c50e696121d1320d09b09468ca735b8c5845d421913db0954b19032898d4c9737ad47450b9e79a0a0f87adb2de8c19a62

Download Submit
C:\Windows\System\LiUaFjK.exe

Filesize
1.1MB

MD5
5bc2ddbe85f41028e5b0c147cd74077d

SHA1
21b4eb58514c60f3c5dc12160fe0d05a90105939

SHA256
29c53094e42ccd1ff756a49a95ac5df3cef465a361008a423555b884d1f1cbd3

SHA512
8a16cabc5c8a47658bd57aa9c33bafedd311f22e1d457425fac8f587a4bdf8b969cbdc6befb4d8595c911a5c8eb143d9ef891ed3724c673c7aa45842bb5fac81

Download Submit
C:\Windows\System\NklZljZ.exe

Filesize
1.2MB

MD5
20acf05dc286e6224df11e555a531ed8

SHA1
9195113469f5d2b22cc7b78d3e24e73ca123d473

SHA256
d677598fa3c29a176996f884e4abba79cfdcb6f806309f85464cbb47db4235a3

SHA512
e904c8c2acb430c53497eb0ab0b679d5422e4df101824645984260b522dce8fc67459d1c4102afd01072658d632490d7eb9c9bfec098fd314c837d6651d658af

Download Submit
C:\Windows\System\OYKPfcb.exe

Filesize
1.2MB

MD5
3b21eccc8f869234927fca45411be421

SHA1
06ee2b6eda626b452bcbb9726e370222cd93008a

SHA256
1f43d71be66e5e392e0e47cae37ac5b528c225da4e4ff4ad5823ca3d0834ce73

SHA512
5714f89c919bdf1fcd37e503c7e85ff6ecd56b9c4e48aef93f85a2bdb4c88981633b31140ca59ffe1fff5bf0c32b14d99938005aa2bdbc797736f7a02a7f97e6

Download Submit
C:\Windows\System\OusiOso.exe

Filesize
1.1MB

MD5
dba345bc602e16dab12ddf49d1c3bade

SHA1
38c65a1dc44f560d92b6d500cf9638e14fac1495

SHA256
1217520e6bdb0a3cd00421b3eb3a8f30f0b63a6a79da925335b40ff2f9e7afbb

SHA512
b3d8cebe9515b18a6ab8c1a4c75a5a247dffe740069587fdea505351f85210f753df6b46ca64750928b8d6e3d1b65b1c3229a6832d921879c1553bdd289eb616

Download Submit
C:\Windows\System\QpUYbFR.exe

Filesize
1.2MB

MD5
8c45049c3481f0240d0fdb7209195d6c

SHA1
82408a0c1a1720d99d276b791333021521edd90b

SHA256
40b3fbf374a48ff39792d28cf3b1a229143a4f53db756178396610fd135c3384

SHA512
7a497ce77e1ca03f3a90d6b64657b6f3edc4b6c049d90e83a89ac138a88688b1d85f4f3745b1d644443350fb515833dcad557751dc0a6f2766e1f524a758e488

Download Submit
C:\Windows\System\RmJJWjY.exe

Filesize
1.2MB

MD5
1d46bfa220893f91312156d35b9ffaab

SHA1
aa272d1b4f3417b6ff5d1965e1bbbcb57c1433ef

SHA256
bbdd6c3d53d26056b2dd3afb6ff6e807887370e225517f996b56c03a58230dab

SHA512
4c444e4a5f38282e5f96fa71235b25c31c0d65a6fbc83ed2259d5283411803b058ead7a534f8af178b63cd757cdf821d5f4c50e09974ac04238b9ed9edfe6eea

Download Submit
C:\Windows\System\SFJqNTX.exe

Filesize
1.2MB

MD5
228b0007d511e17aef521bdb3922f282

SHA1
633b13d91ffd0dc5dd0bced73066c422975d2a58

SHA256
e5299c34d19b70d7c031cb09478378a70b3b16e45055ba7f5fb7d8be01251759

SHA512
5018e998576a6c2503f8f8256cfe5d787b92b9b6ff639489991a634c22b4e6f8261c4ce3311b9ccd9cfbc6d123b8dce8ef70f13b7816496d68c60455b4588d66

Download Submit
C:\Windows\System\TavFbjx.exe

Filesize
1.2MB

MD5
36383a9f4a5f89d5057035a4169dce0c

SHA1
db6edad44e5389dfea3c22152900aa30d10f19c2

SHA256
227163ccd210195ae3e59b65771c938a42278443e5ba25fb7f3a3e0dcd0ef7a0

SHA512
f12f54dd0a198b986c03b90c496fd3aabec67c205393d43346da6ca0d5321e0215b3c51f664cba5323fb73544ef04d28619df7d9cc49e542dbc075beea5af75e

Download Submit
C:\Windows\System\WFaVVlE.exe

Filesize
1.2MB

MD5
88b3a5f6ae73d627e8a4f82752615fe0

SHA1
1b38c9bb2aab8e96ca92fd6392171765f6b61e7a

SHA256
0af761a3478177be5d36fda6c94ffec181157fef2d1230f102aab0ed6a27448c

SHA512
7bedd273d3bd805abe73053de5b8484fbdb3e3daa3211ee23816db866cf2e51a7bfdcfb00c5886ded12dd60dcd32f02e885afb46ad8d79fa3bf7a2576f49b8fc

Download Submit
C:\Windows\System\XSlzqvZ.exe

Filesize
1.2MB

MD5
5caeebeeb6a67ac26df1450f5bc0960a

SHA1
975774e9131ec2549fce8b2e4c65d173590ce3c0

SHA256
d7381c6ec0e5f6e29e9ee3c7a9edc502d1605cad4a442484bfe60002b0ce6a34

SHA512
e1d6d3a02ab17a78bb37f05987aa6e74c4af4c5e4f26c13c81220220df913ea1fa00a68e23be89609b669e117e4aeec37780c62beaebbe0c076e0e71e9c938ab

Download Submit
C:\Windows\System\bPjxBeC.exe

Filesize
1.2MB

MD5
355fc7e6002369cce402e1212670690d

SHA1
1fdd460c928a7108a9aebd317b04629399bfe7c2

SHA256
d879318e0109a4fdf728ccef8f987dab00a3c30dc227b1654c60496aba6704ec

SHA512
b62bb805b72d443672ec721297ce868aa68dc65eed104431f959ea56fdd6c36798bfb0d2f8da6b47bb816fb1cafead4641c448e0c59d6c96eb293c3ebeebbfac

Download Submit
C:\Windows\System\cruZFBn.exe

Filesize
1.2MB

MD5
97f869b0e73791356461ceb9f1e33dd7

SHA1
252101c21edfebcdd711a3234404a499c10b84c8

SHA256
be92df22cfc9eaca0475d099d6d3400246136e1cd692d2a12f3629f841ba0e97

SHA512
3e1af2cc1a512066cdc1761001c275a24c7e1af7fbd5b0e6409b8cdb642f2b8d0e2c182dfddea89d7487dd3316c0ae327b9a15e932a304cbbb13f52005bbccfb

Download Submit
C:\Windows\System\eTuoIWv.exe

Filesize
1.2MB

MD5
597a865c95edef728130cc405ef50c75

SHA1
289fbb03850431a8fad81bf6e91d310c3ef7d330

SHA256
16a5b3b55f3e37584b66793d0b363d32465d01ef84062b39b56aa0a681a3ab2d

SHA512
d72eac5c533f3bd7e29c1254c846b1818ac8bd12f8ad6c42f0955ee7a8927845ec6f912bdf1ac7b31d88825645ea978190bfbfae9c7fb846442d4ce0f78d8170

Download Submit
C:\Windows\System\fSkkvcV.exe

Filesize
1.2MB

MD5
11016eb3342c272dc76475a00f1cc0ca

SHA1
bf13ff3c2419a91fbbe85415b809200bdfbec722

SHA256
b45063e7e907b683e2e95a98459bddac6995a754c951984ce336df95ae6770f5

SHA512
0c046a5cde881f8b5a5e0eb47575cf9708924e466c1f626c4ba6e91e2133236154077f16dc109b063240738c29a1ef9c0d77e67dd22f71a495ec57b7452e7d93

Download Submit
C:\Windows\System\gpAbZuR.exe

Filesize
1.2MB

MD5
b43de20c0bee592a649c78d1a97bab4e

SHA1
22c4ff5168b07779309a3bceac0a2788bd673e47

SHA256
4a87a5fca1fc2c5753e1b52a09c477957ac1512d8c8bb5fd264ce7f45d5ce52c

SHA512
1364c20cca2fc0640061083ef953d31347c8a9542df903b6cfc8563e24d85787a08fd80a2ceb3cce664fa44e264bd4702eacec69e3bebbb0d48d1fb813b3ef91

Download Submit
C:\Windows\System\kKwPujq.exe

Filesize
1.2MB

MD5
0c5832ef76af9201786e115695e593f6

SHA1
43f20df34891483a641fdd1519d1c3436b4e881f

SHA256
70aa2128c2cfada559bc3bec1e40afb3d5e790dfd0df0ce1af866d9436ddd4c2

SHA512
26a0487e47e91cf68f7817e2bb291a9c5898258f7fa389289b5db4674853c78f6eb2e09b41cf5f00063d03de6f8447f5fce1f66cb5a1f17f64d86ba80503129c

Download Submit
C:\Windows\System\kkqtHyw.exe

Filesize
1.2MB

MD5
33711c4f518eb1c07f97edc6f5f7f1cf

SHA1
67e00f83d4cfc6a32f63758c6da2835acde43006

SHA256
b7dc1cc1791928d36c60cccf60305810fa2c0a0968efcb460f5e8d626c8e180d

SHA512
b2b15d0a42540832f3382c3906e59784e28985635c5ef61db35614c440331896d50f064b5c262eb14750529639e295e332a9f8eeee971ba7258e630f1b53427f

Download Submit
C:\Windows\System\klbAwPe.exe

Filesize
1.2MB

MD5
d0e67170062d4dee768a036d4c17caf7

SHA1
832c7e4ac1fa82f44d395a3cabfaf4474f9c1731

SHA256
753af4c4d3926ca7403247d575cb4c4281a80c1d181f50f06500160e9a2754a0

SHA512
290d39ad1717677844c95a41cd059ceceb399794d68e694f067c70f1066dd74c88f0bae8a03f2b01741d436ac5f9e8b2438f54cbfd0236a69a199f671a63e591

Download Submit
C:\Windows\System\lETjWLR.exe

Filesize
1.2MB

MD5
3ab7ff72c4499a75457b062619a4f23e

SHA1
281ab1174ad2a50f2d00f6b1620fc1539c94f1f0

SHA256
5d8040014d7f9fbd997ce7dfdc77b1c1725ab7e6b3d34cb6097f3b42b0fa76b7

SHA512
a096055c4a43b3334de86f94e24c2e8738ba4746685215f45ea82cbdfc19419ea028739d08eb8758f76f4fc40c7aad2b945767db5f5642a348912dd8da00f774

Download Submit
C:\Windows\System\mdFRjiM.exe

Filesize
1.1MB

MD5
43bebfe7cfa736cda3d75c7d33c5787d

SHA1
f855f52159c81dafeb3999dd05f676cf15626f3f

SHA256
38a8549c7a498b6ce7a7dedfe657830fee818adf6d7e3962109be66cd61d7bb9

SHA512
f80dc57f4f33af29c8710d945d308341a307c31fb0ab20662f2ea7b8ec65fb4185c3153f80f43cb6d7ff6ae540f09eeeded2a4e61a47104fbf3f25aceec46335

Download Submit
C:\Windows\System\mgDWiAB.exe

Filesize
1.2MB

MD5
147fb7a4ddd3e58922e0df1935cbd132

SHA1
302e0ad668a063cab6feb2a7dfb1861e98e0f429

SHA256
2a8901ae4c17e147be2c2f230a72dc1bba5f1be5aacbadbe534de86ac7a05c22

SHA512
16a97c1023f7668c71749f043788549c50d7928a3d88b2b265ca003e06baa424dd4e4db625cb9719b135bd2b12edbaf9af6c75092ef2382cb6412384121d3bbf

Download Submit
C:\Windows\System\nopUgBb.exe

Filesize
1.2MB

MD5
ade8f49de23b3dc2557d85f44bf828dd

SHA1
3e73abe98fe1b81d5dc62fce4c17525e7a4012dd

SHA256
c82b8c8af1083be875ed33fb8f6d18f39cafc98c11165511610d817769350d5b

SHA512
200bc3d7da5c969e4da3fca3b4e5e5612898959be48cd18ae8ac72f1f219d6e9493bbbafbff0fbe1c00f50a24840f04f433daf37b8fedea0dfd7105f8d7894bf

Download Submit
C:\Windows\System\qBZGMwH.exe

Filesize
1.2MB

MD5
87020aa8af2a072bb4b8e772b0861218

SHA1
256a1b31bf549b2bfca1efe451ee28a02f9a053b

SHA256
0c5e057233e1e8eb3284644744d8d95a08cb4ca933b16409a39a89e5d06226ea

SHA512
7baee4b991927af28416887352ceb38a7a1492ea8b8806edf60445cda0bcbb4fe667d42b73e399172b8d50cfc877f993dc44618bdc13bd4bef85a2bdd2889b6c

Download Submit
C:\Windows\System\sSCJHwe.exe

Filesize
1.2MB

MD5
764b41bdd1bba1f5235088f5bc156207

SHA1
1746fdd450378e70ab3b3c0148aa608fc97a6856

SHA256
8e9910de222ed3f0e3d48e70a8987330ed72b1aa1c00cef8b678a33cef420e6a

SHA512
c713ad824a7533a32e8c3470f6d1d4b11fb695ca3547bbbbe01ba7bfe95b1fed52e0f44e900ae62299cb24a8d1196d28017436b56b5c99e09630ba45645b4e7d

Download Submit
C:\Windows\System\tASPoqu.exe

Filesize
1.1MB

MD5
22360159f2dfb4d48b6e32311802aa3b

SHA1
7e5ba070060360066abbadc4957c0382d9a2b927

SHA256
1efd918929c5ea937dde2d2d477ec664a93fbcdd5c4b97bee4a28df99cfb49aa

SHA512
139460fb246a501fbced42206c42caafa18a8fdaec4a22edc217b656293024f331930b74a7b20be4fdaa5210d798a48f2f34e64bafe3f6c2de563e0ab031cb4f

Download Submit
C:\Windows\System\tzvukaq.exe

Filesize
1.2MB

MD5
d902df478744b9f1ee5b6c9ba4f9bb5e

SHA1
1d6b5f4867ea9d640dcdf65b075122f01528553d

SHA256
2e034ae1eee4fb387b2672ae17ffdd059034685fc95b689d5447a56d7bc0d575

SHA512
9558dea5d67d3001ca2a11ed78b8c4a408567ea5119e12e2964d50fd96c20663b6f25a904c62983ce9a314ff19819a4b2cb4eed688038cc1e693a289cf7db942

Download Submit
C:\Windows\System\uzEoVwv.exe

Filesize
1.2MB

MD5
20ec31dee29ce9882099e74519ca4007

SHA1
7312dad367bef3bca1ddd77c777b1b1feafbb563

SHA256
d9d96a4785003f7cd5643a8d9e4f739c08189d3b69cbdc1830080534f3cd8e1b

SHA512
2ec83627421dd672463f65347faaa85dfacda536cdb5691186a403822ba0f2479506da818f57be128c720582cdf49cccd213d0250501032622d9a452eb748665

Download Submit
C:\Windows\System\vrCyxol.exe

Filesize
1.2MB

MD5
655b41afee1bb3cd17a9b90d2163d9b6

SHA1
72c99b095310b67bc8fff5ad1bab0d01651e0150

SHA256
8f54e2106edd8e31dfbf4dee6246389d12ef1368a81aa0d488f59db610c194cc

SHA512
301e914186ac38d9bf4174d0f9614bd43f2f98880b01a9a9f6afed40b183d051af3dddb26d515ae1290005828aaafbaf6d9143dec23754d8de4a6dbd0e63b311

Download Submit
memory/1208-0-0x0000026DF9960000-0x0000026DF9970000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads